CWE-294

{
  "affected": [],
  "aliases": [
    "CVE-2019-11334"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-11T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "An authentication bypass in website post requests in the Tzumi Electronics Klic Lock application 1.0.9 for mobile devices allows attackers to access resources (that are not otherwise accessible without proper authentication) via capture-replay. Physically proximate attackers can use this information to unlock unauthorized Tzumi Electronics Klic Smart Padlock Model 5686 Firmware 6.2.",
  "id": "GHSA-cxfm-8p22-p9qx",
  "modified": "2023-03-24T18:30:20Z",
  "published": "2022-05-24T16:47:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11334"
    },
    {
      "type": "WEB",
      "url": "https://github.com/whitehatdefenses/KlicUnLock"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/153280/Tzumi-Electronics-Klic-Lock-Authentication-Bypass.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/treeverse/lakefs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.75.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68671"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T21:14:55Z",
    "nvd_published_at": "2026-01-15T23:15:49Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nLakeFS\u0027s S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. An attacker who captures a valid signed request (e.g., through network interception, logs, or compromised systems) can replay that request until credentials are rotated, even after the request is intended to expire.\n\n### Patches\nThis issue affects all versions of lakeFS up to and including v1.74.4.\n\nThe vulnerability has been fixed in version v1.75.0.\n\nUsers should upgrade to version v1.75.0.\n\n### Workarounds\n\nUntil upgraded, implement these mitigations:\n\n- **Use short-lived credentials** - Rotate access keys frequently and **deactivate old keys**. For regular requests, captured requests only work until rotation. For presigned URLs, they remain valid until the credentials used to create them are deactivated.\n- **Network controls** - Restrict S3 gateway access to trusted networks/IPs to limit where replay attacks can originate.\n\nNote: These workarounds reduce risk but do not fully eliminate the vulnerability.\n\n### References\n- Original issue: https://github.com/treeverse/lakeFS/issues/9599\n- AWS Signature V4 Documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html\n- AWS Signature V4 S3 Requests: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html\n- AWS Signature V2 Documentation: https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.html",
  "id": "GHSA-f2ph-gc9m-q55f",
  "modified": "2026-01-16T15:20:36Z",
  "published": "2026-01-15T21:14:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/security/advisories/GHSA-f2ph-gc9m-q55f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68671"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/issues/9599"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/pull/9710"
    },
    {
      "type": "WEB",
      "url": "https://github.com/treeverse/lakeFS/commit/92966ae611d7f1a2bbe7fd56f9568c975aab2bd8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/treeverse/lakeFS"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "lakeFS is Missing Timestamp Validation in S3 Gateway Authentication"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-2846"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-30T05:15:09Z",
    "severity": "CRITICAL"
  },
  "details": "Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets.",
  "id": "GHSA-f86h-3pcp-x4mw",
  "modified": "2024-04-04T05:18:39Z",
  "published": "2023-06-30T06:30:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2846"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/vu/JVNVU94519952"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04"
    },
    {
      "type": "WEB",
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-5307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-06-04T19:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Some Huawei 4G LTE devices, P30 versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1), are exposed to a message replay vulnerability. For the sake of better compatibility, these devices implement a less strict check on the NAS message sequence number (SN), specifically NAS COUNT. As a result, an attacker can construct a rogue base station and replay the GUTI reallocation command message in certain conditions to tamper with GUTIs, or replay the Identity request message to obtain IMSIs. (Vulnerability ID: HWPSIRT-2019-04107)",
  "id": "GHSA-f9r5-w77x-85qf",
  "modified": "2024-04-04T00:51:35Z",
  "published": "2022-05-24T16:47:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5307"
    },
    {
      "type": "WEB",
      "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190529-01-replay-en"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-41541"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-18T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to the web application as an admin user.",
  "id": "GHSA-fh5v-7v62-vh5h",
  "modified": "2022-10-20T19:00:30Z",
  "published": "2022-10-18T19:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41541"
    },
    {
      "type": "WEB",
      "url": "https://github.com/efchatz/easy-exploits/tree/main/Web/TP-Link/Replay"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/download/archer-ax10/v1/#Firmware"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-29851"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-22T23:15:09Z",
    "severity": "HIGH"
  },
  "details": "Veeam Backup Enterprise Manager allows high-privileged users to steal NTLM hash of Enterprise manager service account.",
  "id": "GHSA-fmh4-p5x3-6hxh",
  "modified": "2024-05-23T00:30:37Z",
  "published": "2024-05-23T00:30:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29851"
    },
    {
      "type": "WEB",
      "url": "https://veeam.com/kb4581"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Sustainsys.Saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Sustainsys.Saml2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Kentor.AuthServices"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-41890"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-289",
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-20T23:01:52Z",
    "nvd_published_at": "2023-09-19T15:15:52Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nWhen a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider.\n\nAn application is impacted if they rely on any of these features in their authentication/authorization logic:\n* the issuer of the generated identity and claims\n* items in the stored request state (AuthenticationProperties)\n\n### Patches\nPatched in version 2.9.2 and 1.0.3. All previous versions are vulnerable.\n\n### Workarounds\nThe `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible.\n\n### References\nThe patch is linked to https://github.com/Sustainsys/Saml2/issues/712 and https://github.com/Sustainsys/Saml2/issues/713\n",
  "id": "GHSA-fv2h-753j-9g39",
  "modified": "2024-10-11T15:37:58Z",
  "published": "2023-09-20T23:01:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/security/advisories/GHSA-fv2h-753j-9g39"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41890"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/issues/712"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sustainsys/Saml2/issues/713"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sustainsys/Saml2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27662"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-15T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01",
  "id": "GHSA-fv2j-64xc-r4hr",
  "modified": "2022-05-24T19:14:40Z",
  "published": "2022-05-24T19:14:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27662"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.gov/ics/advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-22267"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-02-09T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Idelji Web ViewPoint Suite, as used in conjunction with HPE NonStop, allows a remote replay attack for T0320L01^ABP through T0320L01^ABZ, T0952L01^AAH through T0952L01^AAR, T0986L01 through T0986L01^AAF, T0665L01^AAP, and T0662L01^AAP (L) and T0320H01^ABO through T0320H01^ABY, T0952H01^AAG through T0952H01^AAQ, T0986H01 through T0986H01^AAE, T0665H01^AAO, and T0662H01^AAO (J and H).",
  "id": "GHSA-fv88-77rc-98g3",
  "modified": "2022-05-24T17:41:37Z",
  "published": "2022-05-24T17:41:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22267"
    },
    {
      "type": "WEB",
      "url": "https://idelji.com"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US\u0026docId=hpesbns04076en_us"
    },
    {
      "type": "WEB",
      "url": "https://techpartner.ext.hpe.com/TechPartner/PartnerDetail.xhtml?Partner=Idelji"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "mpp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-288",
      "CWE-294",
      "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:20:45Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\nMultiple vulnerabilities were discovered which allowed for undesirable behaviors, including:\n- Performing free `tempo/charge` requests\n- Replaying existing `tempo/charge` requests\n- Performing free `tempo/session` requests\n- Piggybacking off existing `tempo/session` channels\n- Griefing existing `tempo/session` channels\n- Manipulate the fee payer of a `tempo/charge` or `tempo/session` handler into paying for requests\n- Replaying existing `stripe/charge` requests\n\n### Patches\nThe issues are patched in 0.8.0\n\n### Workarounds\nThere are no workarounds available for these vulnerabilities",
  "id": "GHSA-fxc9-7j2w-vx54",
  "modified": "2026-03-29T15:20:45Z",
  "published": "2026-03-29T15:20:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tempoxyz/mpp-rs/security/advisories/GHSA-fxc9-7j2w-vx54"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tempoxyz/mpp-rs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tempoxyz/mpp-rs/releases/tag/v0.8.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "mpp has multiple payment bypass and griefing vulnerabilities"
}