11612 matches found
CVE-2021-29851
IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser. IBM X-Force ID: 205527...
CVE-2021-29852
CVE-2021-29852 affects IBM Planning Analytics Local 2.0; a cross-site scripting flaw in the Web UI could allow embedding arbitrary JavaScript and potentially disclose credentials within a trusted session. Affected: IBM Planning Analytics Local 2.0 (Planning Analytics Workspace). Root cause: XSS i...
CVE-2021-29851
CVE-2021-29851 affects IBM Planning Analytics Local 2.0 (Planning Analytics Local, 2.0). A vulnerability allows a remote attacker to obtain sensitive information when a stack trace is returned in the browser, i.e., an information disclosure. Public sources in the connected documents corroborate a...
LockBit Jumps Its Own Countdown, Publishes Bangkok Air Files
After Bangkok Airways disclosed that it had been clobbered by a cyberattack last week, the LockBit 2.0 ransomware gang tossed its own countdown clock in the trash and went ahead and published what it claims are the airline’s encrypted files on its leak site. BleepingComputer posted an image shown...
PT-2021-6512 · Eclipse +2 · Eclipse Mosquitto +2
Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 2.0 through 2.0.11 Description: The issue is related to the dynamic security plugin in Eclipse Mosquitto. When the ability for a client to make subscriptions on a topic is revoked while a durable client is offline,...
CVE-2021-39171
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...
CVE-2021-39171
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...
Authentication flaw
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...
CVE-2021-39171 Unlimited transforms allowed for signed nodes
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...
CVE-2021-39171
Passport-SAML is affected by a resource-exhaustion issue in transforms prior to version 3.1.0, where a malicious SAML payload can cause high CPU/memory usage and deny service. The root cause is unrestricted transforms on signed nodes, which could lead to denial-of-service under crafted loads. The...
ForgeRock AM XML Injection Vulnerability
ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA designed to quickly enable a superior experience tailored to the unique needs of users and employees.ForgeRock Access Management AM prior to 7.0.2 versions contained an XML injection vulnerability that could be...
Photon OS 2.0: Nxtgn PHSA-2021-2.0-0383
An update of the nxtgn package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0383. The text itself is copyright C VMware, Inc...
Photon OS 2.0: Glibc PHSA-2021-2.0-0383
An update of the glibc package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0383. The text itself is copyright C VMware, Inc...
Fedora: Security Advisory for dotnet5.0 (FEDORA-2021-bb02f6ca8a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-37154
In ForgeRock Access Management AM before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion...
Design/Logic Flaw
In ForgeRock Access Management AM before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion...
CVE-2021-37154
ForgeRock Access Management (AM) before 7.0.2 has a vulnerability in its SAML2 implementation that allows XML injection, potentially enabling fraudulent SAML 2.0 assertions. Affected component: AM SAML2 handling. Root cause: XML injection in SAML processing. Impact: high confidentiality, integrit...
Researchers Warn of 4 Emerging Ransomware Groups That Can Cause Havoc
Cybersecurity researchers on Tuesday took the wraps off four up-and-coming ransomware groups that could pose a serious threat to enterprises and critical infrastructure, as the ripple effect of a recent spurt in ransomware incidents show that attackers are growing more sophisticated and more...
Photon OS 2.0: Util PHSA-2021-2.0-0379
An update of the util package has been released. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0379. The text itself is copyright C VMware, Inc. include'deprecatednasllevel.inc...
Security Bulletin: Apache CXF (Publicly disclosed vulnerability)
Summary CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a U...