@DTCERT-
Rasa (un)authenticated Remote Code Execution via remote model loading (CVE-2024-49375)
During an internal penetration test a product was checked which uses Rasa to build a conversational AI. A mixture of penetration testing and source code analysis led to the discovery of an (un)authenticated Remote Code Execution.
-
Multiple critical vulnerabilities in SICK DL100-2xxxxxxx Products
Several vulnerabilities were discovered during testing of a DL100 device.
-
Remote code execution in LDAP Account manager through CVE-2024-23333 (Exploiting web applications Part I)
During red teaming engagements, the first step is to gain a foothold in the client’s network. That might happen through a phishing attempt, malicious payloads, physical access to the client’s site or an assumed breach. But what happens once you got access to the network?
-
Remote buffer overflow vulnerability in SharkSSL TLS handshake processing
A new remote buffer overflow vulnerability was discovered in the latest version of the SharkSSL library from 05.05.2024 (https://github.com/RealTimeLogic/SharkSSL) by security evaluators of Deutsche Telekom Security GmbH and Deutsche Telekom AG with modern fuzzing methods.
-
Tuta Mail Vulnerability - Client Information Leak
An client information leak vulnerability (CVE-2024-23330) has been identified in Tuta Mail. This vulnerability could leak client information by loading external resources in the mail even if disabled.
-
Tuta Mail Vulnerability - DoS
A denial of service vulnerability (CVE-2024-23655) has been identified in Tuta Mail. This vulnerability could prevent users from accessing and reading received mails when an attacker sends a manipulated mail.
-
Apple ARKit Vulnerability - Heap Overflow
A heap corruption vulnerability (CVE-2024-44126) has been identified in several Apple products that use the ARKit component. This vulnerability could compromise the security of devices when processing a specially crafted file.
-
Remote buffer overflow vulnerability in SharkSSL TLS Client Key Exchange handshake processing
A new remote buffer overflow vulnerability (CVE-2024-48075) was discovered in the latest version of the SharkSSL library from 09.09.2024 (https://github.com/RealTimeLogic/SharkSSL) by security evaluators of Deutsche Telekom Security GmbH and Deutsche Telekom AG with modern fuzzing methods.