Pardus
Monthly
Authentication bypass in TUBITAK BILGEM Pardus (versions <=0.6.4 up to 0.8.0) stems from improper neutralization of CRLF sequences, letting remote attackers manipulate protocol/header handling to circumvent authentication controls when a user is lured into triggering the crafted request. Reported by TR-CERT, the flaw carries a CVSS 8.8 with total technical impact per CISA SSVC, though EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis. A vendor patch (0.8.0) is available.
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. Rated critical severity (CVSS 9.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authentication bypass in TUBITAK BILGEM Pardus (versions <=0.6.4 up to 0.8.0) stems from improper neutralization of CRLF sequences, letting remote attackers manipulate protocol/header handling to circumvent authentication controls when a user is lured into triggering the crafted request. Reported by TR-CERT, the flaw carries a CVSS 8.8 with total technical impact per CISA SSVC, though EPSS is very low (0.05%, 17th percentile) and there is no public exploit identified at time of analysis. A vendor patch (0.8.0) is available.
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. Rated critical severity (CVSS 9.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.