Filtered by vendor Bishopfox
Subscribe
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25791 | 1 Bishopfox | 1 Sliver | 2026-02-23 | N/A | 7.5 HIGH |
|
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
|
|||||
| CVE-2026-25760 | 1 Bishopfox | 1 Sliver | 2026-02-19 | N/A | 6.5 MEDIUM |
|
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in the website content subsystem lets an authenticated operator read arbitrary files on the Sliver server host. This is an authenticated path traversal / arbitrary file read issue, and it can expose credentials, configs, and keys. This vulnerability is fixed in 1.6.11.
|
|||||
| CVE-2025-27090 | 1 Bishopfox | 1 Sliver | 2025-02-27 | N/A | 5.3 MEDIUM |
|
Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the server's IP address to a third party. This issue has been addressed in version 1.5.43 and all users ar ...
Show More |
|||||
| CVE-2023-34758 | 1 Bishopfox | 1 Sliver | 2024-11-21 | N/A | 8.1 HIGH |
|
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
|
|||||