CWE-294
AllowedAuthentication Bypass by Capture-replay
Abstraction: Base · Status: Incomplete
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
387 vulnerabilities reference this CWE, most recent first.
GHSA-VPXW-2HR2-2MV5
Vulnerability from github – Published: 2025-09-15 21:30 – Updated: 2025-09-15 21:30The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured transmissions. This exposes users to significant security risks, including vehicle theft and loss of trust in the alarm's anti-cloning claims.
{
"affected": [],
"aliases": [
"CVE-2025-56448"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-15T20:15:38Z",
"severity": "MODERATE"
},
"details": "The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured transmissions. This exposes users to significant security risks, including vehicle theft and loss of trust in the alarm\u0027s anti-cloning claims.",
"id": "GHSA-vpxw-2hr2-2mv5",
"modified": "2025-09-15T21:30:56Z",
"published": "2025-09-15T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56448"
},
{
"type": "WEB",
"url": "https://medium.com/@wagneralves_87750/cve-2025-56448-replay-attack-vulnerability-in-positron-px360bt-car-alarm-system-c9f1ccea6ebe"
},
{
"type": "WEB",
"url": "https://positron.com.br/blog/positron-lanca-alarme-px360bt-starter"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VQFP-P66C-XRP9
Vulnerability from github – Published: 2026-08-13 14:12 – Updated: 2026-08-13 14:12Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body
Description
Etherpad ships an endpoint pair under /tokenTransfer (src/node/hooks/express/tokenTransfer.ts) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is:
- POST
/tokenTransfer— the source device sends a request whose own author cookie is read off the server-side cookie jar. The server mints a random UUID and stores the author token (and arbitraryprefsHttpfield) under a DB key keyed by that UUID. The UUID is returned. - GET
/tokenTransfer/{uuid}— the destination device GETs the URL containing the UUID. The server reads the stored record and sets the HttpOnly author cookie on the response.
The original implementation has three serious flaws:
- No expiration check.
createdAtis written to the record on POST but never inspected on GET. A leaked transfer URL is redeemable indefinitely. - No single-use enforcement. The DB record is not deleted after a successful GET, so the same URL can be redeemed repeatedly — each redemption yielding a fresh cookie set on whoever issued the GET.
- Author token echoed in the response body. The GET handler ends with
res.send(tokenData), which serializes the full record — including the raw author token — into the JSON response. Any JavaScript on the page that issued the GET can read the token, defeating the HttpOnly cookie design that exists specifically to keep the token out of JS reach.
Combined, these mean that any disclosure of a transfer UUID (browser history, mis-shared QR code, screenshot, server log, third-party plugin that proxies the request, an unencrypted intermediate hop) results in persistent authorship impersonation of the originating account — the attacker doesn't just get one cookie, they can re-redeem and they get the raw token in cleartext for storage / replay against other endpoints.
Severity rationale
- AV:N — exploitable over the network.
- AC:H — requires the attacker to learn the transfer UUID via some out-of-band channel; UUIDs are random.
- PR:N — no authentication required at the redemption endpoint.
- UI:R — the legitimate user must have issued the POST and the UUID must end up where the attacker can see it (QR code, screenshot, etc.).
- C:H / I:H — full author identity takeover (read + write everything that author can).
- A:N — no direct denial-of-service.
CVSS lands at 7.5 (High). Some operators may reasonably score this lower (UI:R + AC:H) if their threat model assumes the transfer URL never leaves the user's own device pair.
Affected versions
ep_etherpad-lite >= 2.6.0, <= 3.0.0. The/tokenTransferendpoint pair was added in41cb680"let user maintain a single session across multiple browsers" (#7228), first tagged in v2.6.0 (2025-11-18). All three flaws (no TTL, no single-use, token in response body) were present from the introducing commit and persisted throughv3.0.0.
Patched versions
ep_etherpad-lite >= 3.1.0— the fix is ondevelopHEAD as commit8c6104c. Update this field with the actual tagged release version when it ships.
Proof of concept
# 1. Victim posts a transfer from their device.
curl -X POST https://pad.example/tokenTransfer \
-H 'Cookie: token=t.victim-author-token' \
-H 'Content-Type: application/json' \
-d '{"prefsHttp": ""}'
# -> {"id": "1f0b2a3c-..."}
# 2. UUID leaks (browser history, intercepted QR, etc.).
# 3. Attacker redeems it from a totally different machine:
curl -i https://pad.example/tokenTransfer/1f0b2a3c-...
# Headers include:
# Set-Cookie: token=t.victim-author-token; Path=/; HttpOnly; ...
# Body contains:
# {"token":"t.victim-author-token", "prefsHttp": "", "createdAt": ...}
#
# Attacker now owns the victim's identity. They can also re-redeem the
# same UUID (no single-use), and the body gives them the cleartext token
# even if the HttpOnly cookie isn't useful to their tooling.
Workarounds
- Disable any UI that surfaces the transfer URL (QR code, copy-button, etc.).
- Reverse-proxy block
/tokenTransfer/*if device-pairing is not in use. - Set short DB cleanup intervals (does not address the JS-readable body issue).
None of these workarounds are sufficient on their own — upgrade is the only complete fix.
Fix
Patched in 8c6104c (PR #7784):
- 5-minute TTL (
TRANSFER_TTL_MS). Records older than this return 410 Gone. Records with absent/non-numericcreatedAt(legacy records from older code paths) are treated as expired. - Single-use. The DB record is removed before the success response is written, so a parallel request that wins the race observes an already-redeemed transfer rather than a second usable copy.
- Body sanitised. The response body becomes
{ok: true, prefsHttp}— the raw author token is no longer included. The HttpOnly cookie set in the same response is the only delivery channel.
- const tokenData = await db.get(`${tokenTransferKey}:${id}`);
+ const key = tokenTransferKey(id);
+ const tokenData: TokenTransferRequest | undefined = await db.get(key);
if (!tokenData) {
return res.status(404).send({error: 'Token not found'});
}
+ await db.remove(key);
+ const createdAt = typeof tokenData.createdAt === 'number'
+ ? tokenData.createdAt : 0;
+ if (Date.now() - createdAt > TRANSFER_TTL_MS) {
+ return res.status(410).send({error: 'Token expired'});
+ }
...
- res.send(tokenData);
+ res.send({ok: true, prefsHttp: tokenData.prefsHttp});
Resources
- Patched in: https://github.com/ether/etherpad/pull/7784 (squash commit
8c6104c). - Vulnerable code introduced in: https://github.com/ether/etherpad/commit/41cb680 (PR #7228), released in v2.6.0.
- Background on the HttpOnly author-token migration: ether/etherpad PR #7548 (PR3 of #6701, released in v2.7.3). That earlier PR addressed two adjacent issues (the cookie was previously non-HttpOnly, and the POST handler previously trusted the request body for the token value). This GHSA covers only the three flaws that remained after that earlier patch.
Credits
Reported during an internal security audit by Claude (via @JohnMcLear).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.0"
},
"package": {
"ecosystem": "npm",
"name": "ep_etherpad-lite"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55088"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-294"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-13T14:12:44Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Etherpad\u0027s device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body\n\n## Description\n\nEtherpad ships an endpoint pair under `/tokenTransfer` (`src/node/hooks/express/tokenTransfer.ts`) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is:\n\n1. **POST `/tokenTransfer`** \u2014 the source device sends a request whose own author cookie is read off the server-side cookie jar. The server mints a random UUID and stores the author token (and arbitrary `prefsHttp` field) under a DB key keyed by that UUID. The UUID is returned.\n2. **GET `/tokenTransfer/{uuid}`** \u2014 the destination device GETs the URL containing the UUID. The server reads the stored record and sets the HttpOnly author cookie on the response.\n\nThe original implementation has three serious flaws:\n\n1. **No expiration check.** `createdAt` is written to the record on POST but never inspected on GET. A leaked transfer URL is redeemable indefinitely.\n2. **No single-use enforcement.** The DB record is not deleted after a successful GET, so the same URL can be redeemed repeatedly \u2014 each redemption yielding a fresh cookie set on whoever issued the GET.\n3. **Author token echoed in the response body.** The GET handler ends with `res.send(tokenData)`, which serializes the full record \u2014 including the raw author token \u2014 into the JSON response. Any JavaScript on the page that issued the GET can read the token, defeating the HttpOnly cookie design that exists specifically to keep the token out of JS reach.\n\nCombined, these mean that any disclosure of a transfer UUID (browser history, mis-shared QR code, screenshot, server log, third-party plugin that proxies the request, an unencrypted intermediate hop) results in **persistent authorship impersonation of the originating account** \u2014 the attacker doesn\u0027t just get one cookie, they can re-redeem and they get the raw token in cleartext for storage / replay against other endpoints.\n\n## Severity rationale\n\n- **AV:N** \u2014 exploitable over the network.\n- **AC:H** \u2014 requires the attacker to learn the transfer UUID via some out-of-band channel; UUIDs are random.\n- **PR:N** \u2014 no authentication required at the redemption endpoint.\n- **UI:R** \u2014 the legitimate user must have issued the POST and the UUID must end up where the attacker can see it (QR code, screenshot, etc.).\n- **C:H / I:H** \u2014 full author identity takeover (read + write everything that author can).\n- **A:N** \u2014 no direct denial-of-service.\n\nCVSS lands at 7.5 (High). Some operators may reasonably score this lower (UI:R + AC:H) if their threat model assumes the transfer URL never leaves the user\u0027s own device pair.\n\n## Affected versions\n\n- `ep_etherpad-lite \u003e= 2.6.0, \u003c= 3.0.0`. The `/tokenTransfer` endpoint pair was added in [`41cb680` \"let user maintain a single session across multiple browsers\" (#7228)](https://github.com/ether/etherpad/commit/41cb680), first tagged in **v2.6.0** (2025-11-18). All three flaws (no TTL, no single-use, token in response body) were present from the introducing commit and persisted through `v3.0.0`.\n\n## Patched versions\n\n- `ep_etherpad-lite \u003e= 3.1.0` \u2014 the fix is on `develop` HEAD as commit `8c6104c`. Update this field with the actual tagged release version when it ships.\n\n## Proof of concept\n\n```\n# 1. Victim posts a transfer from their device.\ncurl -X POST https://pad.example/tokenTransfer \\\n -H \u0027Cookie: token=t.victim-author-token\u0027 \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"prefsHttp\": \"\"}\u0027\n# -\u003e {\"id\": \"1f0b2a3c-...\"}\n\n# 2. UUID leaks (browser history, intercepted QR, etc.).\n# 3. Attacker redeems it from a totally different machine:\ncurl -i https://pad.example/tokenTransfer/1f0b2a3c-...\n# Headers include:\n# Set-Cookie: token=t.victim-author-token; Path=/; HttpOnly; ...\n# Body contains:\n# {\"token\":\"t.victim-author-token\", \"prefsHttp\": \"\", \"createdAt\": ...}\n#\n# Attacker now owns the victim\u0027s identity. They can also re-redeem the\n# same UUID (no single-use), and the body gives them the cleartext token\n# even if the HttpOnly cookie isn\u0027t useful to their tooling.\n```\n\n## Workarounds\n\n- Disable any UI that surfaces the transfer URL (QR code, copy-button, etc.).\n- Reverse-proxy block `/tokenTransfer/*` if device-pairing is not in use.\n- Set short DB cleanup intervals (does not address the JS-readable body issue).\n\nNone of these workarounds are sufficient on their own \u2014 upgrade is the only complete fix.\n\n## Fix\n\nPatched in [`8c6104c`](https://github.com/ether/etherpad/commit/8c6104c) (PR [#7784](https://github.com/ether/etherpad/pull/7784)):\n\n1. **5-minute TTL** (`TRANSFER_TTL_MS`). Records older than this return 410 Gone. Records with absent/non-numeric `createdAt` (legacy records from older code paths) are treated as expired.\n2. **Single-use.** The DB record is removed **before** the success response is written, so a parallel request that wins the race observes an already-redeemed transfer rather than a second usable copy.\n3. **Body sanitised.** The response body becomes `{ok: true, prefsHttp}` \u2014 the raw author token is no longer included. The HttpOnly cookie set in the same response is the only delivery channel.\n\n```diff\n- const tokenData = await db.get(`${tokenTransferKey}:${id}`);\n+ const key = tokenTransferKey(id);\n+ const tokenData: TokenTransferRequest | undefined = await db.get(key);\n if (!tokenData) {\n return res.status(404).send({error: \u0027Token not found\u0027});\n }\n+ await db.remove(key);\n+ const createdAt = typeof tokenData.createdAt === \u0027number\u0027\n+ ? tokenData.createdAt : 0;\n+ if (Date.now() - createdAt \u003e TRANSFER_TTL_MS) {\n+ return res.status(410).send({error: \u0027Token expired\u0027});\n+ }\n ...\n- res.send(tokenData);\n+ res.send({ok: true, prefsHttp: tokenData.prefsHttp});\n```\n\n## Resources\n\n- Patched in: https://github.com/ether/etherpad/pull/7784 (squash commit `8c6104c`).\n- Vulnerable code introduced in: https://github.com/ether/etherpad/commit/41cb680 (PR #7228), released in v2.6.0.\n- Background on the HttpOnly author-token migration: ether/etherpad PR #7548 (PR3 of #6701, released in v2.7.3). That earlier PR addressed two adjacent issues (the cookie was previously non-HttpOnly, and the POST handler previously trusted the request body for the token value). This GHSA covers only the three flaws that remained after that earlier patch.\n\n## Credits\n\nReported during an internal security audit by Claude (via @JohnMcLear).",
"id": "GHSA-vqfp-p66c-xrp9",
"modified": "2026-08-13T14:12:44Z",
"published": "2026-08-13T14:12:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ether/etherpad/security/advisories/GHSA-vqfp-p66c-xrp9"
},
{
"type": "WEB",
"url": "https://github.com/ether/etherpad/pull/7784"
},
{
"type": "PACKAGE",
"url": "https://github.com/ether/etherpad"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token"
}
GHSA-VQX8-9XXW-F2M7
Vulnerability from github – Published: 2026-03-03 19:16 – Updated: 2026-03-30 13:37Impact
Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions.
Affected Packages / Versions
- Package:
openclaw(npm) - Vulnerable versions:
<= 2026.2.22-2 - Patched version (released):
>= 2026.2.23
Remediation
The fix preserves provider event IDs through normalization, adds bounded replay dedupe in webhook security validation, and enforces per-call turn-token checks on call-state transitions.
Fix Commit(s)
- 1d28da55a5d0ff409e34999e0961157e9db0a2ab
Release Process Note
patched_versions is pre-set to the released version (2026.2.23) This advisory now reflects released fix version 2026.2.23.2.23`.
OpenClaw thanks @jiseoung for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32053"
],
"database_specific": {
"cwe_ids": [
"CWE-294",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T19:16:09Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Impact\nTwilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Vulnerable versions: `\u003c= 2026.2.22-2`\n- Patched version (released): `\u003e= 2026.2.23`\n\n## Remediation\nThe fix preserves provider event IDs through normalization, adds bounded replay dedupe in webhook security validation, and enforces per-call turn-token checks on call-state transitions.\n\n## Fix Commit(s)\n- 1d28da55a5d0ff409e34999e0961157e9db0a2ab\n\n## Release Process Note\n`patched_versions` is pre-set to the released version (`2026.2.23`) This advisory now reflects released fix version `2026.2.23`.2.23`.\n\nOpenClaw thanks @jiseoung for reporting.",
"id": "GHSA-vqx8-9xxw-f2m7",
"modified": "2026-03-30T13:37:03Z",
"published": "2026-03-03T19:16:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32053"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/1d28da55a5d0ff409e34999e0961157e9db0a2ab"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-twilio-webhook-replay-bypass-via-randomized-event-id-normalization"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw\u0027s voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse"
}
GHSA-VR32-5VPV-693C
Vulnerability from github – Published: 2025-03-07 12:31 – Updated: 2025-03-07 12:32SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker.
{
"affected": [],
"aliases": [
"CVE-2025-1887"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-07T11:15:16Z",
"severity": "HIGH"
},
"details": "SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a server controlled by the attacker.",
"id": "GHSA-vr32-5vpv-693c",
"modified": "2025-03-07T12:32:00Z",
"published": "2025-03-07T12:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1887"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-sage-200-spain"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VRG5-XM7Q-QCJH
Vulnerability from github – Published: 2026-08-19 18:32 – Updated: 2026-08-19 18:32Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer.
MPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer.
This issue affects mpp: from 0.3.0 before 0.6.3.
{
"affected": [],
"aliases": [
"CVE-2026-67581"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T18:17:17Z",
"severity": "HIGH"
},
"details": "Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer.\n\nMPP.Methods.EVM.verify/2 accepts a transaction-hash credential and matches a transfer purely on token, to and amount (ERC-20) or to and value (native). It binds the proof neither to the challenge being verified nor to any record of prior use, and the generic MPP.Plug dedup store keys on challenge.id, which is regenerated for every 402 response. On a static-price route, a single historical transfer matching the charge therefore satisfies an unbounded number of later charges, including transfers an attacker can read off a public block explorer.\n\nThis issue affects mpp: from 0.3.0 before 0.6.3.",
"id": "GHSA-vrg5-xm7q-qcjh",
"modified": "2026-08-19T18:32:53Z",
"published": "2026-08-19T18:32:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ZenHive/mpp/security/advisories/GHSA-vp5h-xh25-44wf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67581"
},
{
"type": "WEB",
"url": "https://github.com/ZenHive/mpp/commit/ecc038088b1cda09ad8a84acc6cc112addb4a68f"
},
{
"type": "WEB",
"url": "https://cna.erlef.org/cves/CVE-2026-67581.html"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-67581"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VRJX-2RQQ-2J39
Vulnerability from github – Published: 2023-11-17 06:31 – Updated: 2023-11-24 18:30CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.0 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.0 and earlier allows a attacker to log in to the product may execute an arbitrary command.
{
"affected": [],
"aliases": [
"CVE-2023-39547"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-17T06:15:34Z",
"severity": "HIGH"
},
"details": "CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.0 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.0 and earlier allows a attacker to log in to the product may execute an arbitrary command.\n\n",
"id": "GHSA-vrjx-2rqq-2j39",
"modified": "2023-11-24T18:30:30Z",
"published": "2023-11-17T06:31:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39547"
},
{
"type": "WEB",
"url": "https://jpn.nec.com/security-info/secinfo/nv23-009_en.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VVX5-72QC-GGWP
Vulnerability from github – Published: 2022-09-14 00:00 – Updated: 2022-09-16 00:00A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.3.1). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option 'Allow Idp Initiated Authentication' is enabled.
{
"affected": [],
"aliases": [
"CVE-2022-37011"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-13T10:15:00Z",
"severity": "CRITICAL"
},
"details": "A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions \u003c V1.17.0), Mendix SAML Module (Mendix 8 compatible) (All versions \u003c V2.3.0), Mendix SAML Module (Mendix 9 compatible) (All versions \u003c V3.3.1). Affected versions of the module insufficiently protect from packet capture replay. This could allow unauthorized remote attackers to bypass authentication and get access to the application. For compatibility reasons, fix versions still contain this issue, but only when the not recommended, non default configuration option `\u0027Allow Idp Initiated Authentication\u0027` is enabled.",
"id": "GHSA-vvx5-72qc-ggwp",
"modified": "2022-09-16T00:00:30Z",
"published": "2022-09-14T00:00:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37011"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-638652.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VW39-2WJ9-4Q86
Vulnerability from github – Published: 2022-10-11 19:00 – Updated: 2026-06-10 18:44mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django-mfa2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "django-mfa2"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-42731"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-11T20:49:45Z",
"nvd_published_at": "2022-10-11T14:15:00Z",
"severity": "HIGH"
},
"details": "mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.",
"id": "GHSA-vw39-2wj9-4q86",
"modified": "2026-06-10T18:44:18Z",
"published": "2022-10-11T19:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42731"
},
{
"type": "WEB",
"url": "https://github.com/mkalioby/django-mfa2/commit/54db5a513bcafa97a36e9f6dfa31d3c61fa8217b"
},
{
"type": "WEB",
"url": "https://github.com/mkalioby/django-mfa2/commit/5fbb505e98ecdd409330a5c336ad5ec49631b0db"
},
{
"type": "PACKAGE",
"url": "https://github.com/mkalioby/django-mfa2"
},
{
"type": "WEB",
"url": "https://github.com/mkalioby/django-mfa2/blob/0936ea253354dd95cb127f09d0efa31324caef27/mfa/FIDO2.py#L58"
},
{
"type": "WEB",
"url": "https://github.com/mkalioby/django-mfa2/releases/tag/v2.5.1-release"
},
{
"type": "WEB",
"url": "https://github.com/mkalioby/django-mfa2/releases/tag/v2.6.1-release"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django-mfa2/PYSEC-2022-303.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "django-mfa2 vulnerable to MFA Replay attack"
}
GHSA-VWC9-GHVR-RP96
Vulnerability from github – Published: 2025-10-09 21:31 – Updated: 2025-10-09 21:31Newforma Info Exchange (NIX) '/NPCSRemoteWeb/LegacyIntegrationServices.asmx' allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account.
{
"affected": [],
"aliases": [
"CVE-2025-35061"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-09T21:15:37Z",
"severity": "HIGH"
},
"details": "Newforma Info Exchange (NIX) \u0027/NPCSRemoteWeb/LegacyIntegrationServices.asmx\u0027 allows a remote, unauthenticated attacker to cause NIX to make an SMB connection to an attacker-controlled system. The attacker can capture the NTLMv2 hash of the user-configured NIX service account.",
"id": "GHSA-vwc9-ghvr-rp96",
"modified": "2025-10-09T21:31:12Z",
"published": "2025-10-09T21:31:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35061"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-282-01.json"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35061"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VXFP-73R7-QWW7
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of service on mobile network connection.
{
"affected": [],
"aliases": [
"CVE-2021-25480"
],
"database_specific": {
"cwe_ids": [
"CWE-294"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-06T18:15:00Z",
"severity": "HIGH"
},
"details": "A lack of replay attack protection in GUTI REALLOCATION COMMAND message process in Qualcomm modem prior to SMR Oct-2021 Release 1 can lead to remote denial of service on mobile network connection.",
"id": "GHSA-vxfp-73r7-qww7",
"modified": "2022-05-24T19:16:44Z",
"published": "2022-05-24T19:16:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25480"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2021\u0026month=10"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Utilize some sequence or time stamping functionality along with a checksum which takes this into account in order to ensure that messages can be parsed only once.
Mitigation
Since any attacker who can listen to traffic can see sequence numbers, it is necessary to sign messages with some kind of cryptography to ensure that sequence numbers are not simply doctored along with content.
CAPEC-102: Session Sidejacking
Session sidejacking takes advantage of an unencrypted communication channel between a victim and target system. The attacker sniffs traffic on a network looking for session tokens in unencrypted traffic. Once a session token is captured, the attacker performs malicious actions by using the stolen token with the targeted application to impersonate the victim. This attack is a specific method of session hijacking, which is exploiting a valid session token to gain unauthorized access to a target system or information. Other methods to perform a session hijacking are session fixation, cross-site scripting, or compromising a user or server machine and stealing the session token.
CAPEC-509: Kerberoasting
Through the exploitation of how service accounts leverage Kerberos authentication with Service Principal Names (SPNs), the adversary obtains and subsequently cracks the hashed credentials of a service account target to exploit its privileges. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. As an authenticated user, the adversary may request Active Directory and obtain a service ticket with portions encrypted via RC4 with the private key of the authenticated account. By extracting the local ticket and saving it disk, the adversary can brute force the hashed value to reveal the target account credentials.
CAPEC-555: Remote Services with Stolen Credentials
This pattern of attack involves an adversary that uses stolen credentials to leverage remote services such as RDP, telnet, SSH, and VNC to log into a system. Once access is gained, any number of malicious activities could be performed.
CAPEC-561: Windows Admin Shares with Stolen Credentials
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-644: Use of Captured Hashes (Pass The Hash)
An adversary obtains (i.e. steals or purchases) legitimate Windows domain credential hash values to access systems within the domain that leverage the Lan Man (LM) and/or NT Lan Man (NTLM) authentication protocols.
CAPEC-645: Use of Captured Tickets (Pass The Ticket)
An adversary uses stolen Kerberos tickets to access systems/resources that leverage the Kerberos authentication protocol. The Kerberos authentication protocol centers around a ticketing system which is used to request/grant access to services and to then access the requested services. An adversary can obtain any one of these tickets (e.g. Service Ticket, Ticket Granting Ticket, Silver Ticket, or Golden Ticket) to authenticate to a system/resource without needing the account's credentials. Depending on the ticket obtained, the adversary may be able to access a particular resource or generate TGTs for any account within an Active Directory Domain.
CAPEC-652: Use of Known Kerberos Credentials
An adversary obtains (i.e. steals or purchases) legitimate Kerberos credentials (e.g. Kerberos service account userID/password or Kerberos Tickets) with the goal of achieving authenticated access to additional systems, applications, or services within the domain.
CAPEC-701: Browser in the Middle (BiTM)
An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.