[SECURITY] [DSA 4818-1] sympa security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4818-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 23, 2020 https://www.debian.org/security/faq -...

Go365 - An Office365 User Attack Tool

Go365 is a tool designed to perform user enumeration and password guessing attacks on organizations that use Office365 now/soon Microsoft365. Go365 uses a unique SOAP API endpoint on login.microsoftonline.com that most other tools do not use. When queried with an email address and password, the...

Debian DLA-2499-1 : sympa security update

Sympa, a modern mailing list manager, grants full SOAP API access by sending invalid string as the cookie value, if the SOAP endpoint was enabled. An attacker could manipulate the mailing lists, including subscribing e-mails or getting the list of subscribers. For Debian 9 stretch, this problem h...

Debian: Security Advisory (DLA-2499-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2499-1] sympa security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2499-1 [email protected] https://www.debian.org/lts/security/ December 17, 2020 https://wiki.debian.org/LTS - -------------------------------------------------------------------------...

Sympa < 6.2.60 SOAP API Vulnerability

Sympa is prone to an authentication bypass vulnerability in the SOAP API. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

Authorization Bypass

sympa is vulnerable to authorization bypass. The vulnerability exists as remote attackers can obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

DEBIAN-CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

UBUNTU-CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

Code injection

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

CVE-2020-29668

CVE-2020-29668 affects Sympa prior to 6.2.59b.2. The issue allows remote attackers to obtain full SOAP API access by sending an arbitrary string (except one from an expired cookie) as the cookie value to the authenticateAndRun endpoint. The public description in the initial document confirms the ...

CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

CVE-2020-29668: Improper Authentication

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string except one from an expired cookie as the cookie value to authenticateAndRun...

PT-2020-5770

Name of the Vulnerable Software and Affected Versions: Sympa versions prior to 6.2.59b.2 Description: The issue is related to the authenticateAndRun function in the Sympa mailing list manager, which lacks proper cookie value validation. This allows a remote attacker to gain access to confidential...

Cisco IoT Field Network Director SOAP API Authorization Bypass Vulnerability (cisco-sa-FND-AUTH-vEypBmmR)

An authorization bypass vulnerability exists in Cisco IoT Field Network Director IoT-FND due to insufficient authorization in the SOAP API. An authenticated, remote attacker can exploit this, via SOAP API requests, to bypass authorization and access and modify information on devices that belong t...

sympa -- Unauthorised full access via SOAP API due to illegal cookie

Sympa community reports: Unauthorised full access via SOAP API due to illegal cookie...

CVE-2020-26072

A vulnerability in the SOAP API of Cisco IoT Field Network Director FND could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit th...