CVE-2020-9482

CVE-2020-9482 affects NiFi Registry versions 0.1.0 to 0.5.0. The root cause is using an authentication mechanism other than PKI where, on logout, the server does not invalidate the token; only the client-side token is invalidated. As a result, the token may remain usable for up to 12 hours after ...

Improper Token Handling

Apache NiFi Registry is vulnerable to authentication bypass. During logging out, the authentication mechanism other than PKI does not invalidate the token on the server side, but only on the client side, allowing the client to make a API requests up to 12 hours after logging out...

PT-2020-20692

Name of the Vulnerable Software and Affected Versions NiFi Registry versions 0.1.0 through 0.5.0 Description The issue arises when NiFi Registry uses an authentication mechanism other than PKI. Upon clicking Log Out, NiFi Registry invalidates the authentication token on the client side but fails ...

CVE-2020-9482: Insufficient Session Expiration

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging ou...

CVE-2019-4751

IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. IBM X-Force ID: 173311...

Information disclosure

IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. IBM X-Force ID: 173311...

CVE-2019-4751

CVE-2019-4751 affects IBM Cloud App Management 2019.3.0 and 2019.4.0, where API requests reveal a stack trace that can disclose implementation details. This is an information-disclosure vulnerability stemming from stack traces exposed by the service. Affected versions: IBM Cloud App Management V2...

CVE-2019-4751

IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. IBM X-Force ID: 173311...

CVE-2019-4751: Exposure of Sensitive Information to an Unauthorized Actor

IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. IBM X-Force ID: 173311...

PT-2020-11059

Name of the Vulnerable Software and Affected Versions IBM Cloud App Management versions 2019.3.0 through 2019.4.0 Description The issue allows an attacker to gain further information about the implementation of the offering by revealing a stack trace on certain API requests. Recommendations For I...

Security Bulletin: A vulnerability in IBM Cloud App Management reveals a stack trace on certain API requests (CVE-2019-4751)

Summary IBM Cloud App Management reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. This vulnerability has been addressed by IBM Cloud App Management in a later version. Vulnerability Details CVEID: CVE-2019-4751...

CVE-2020-8552

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests...

Directory traversal

Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. dot dot in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete...

Cross site request forgery (csrf)

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. CSRF can be used to send API requests...

CVE-2019-16513

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. CSRF can be used to send API requests...

CVE-2019-16513

ConnectWise Control (formerly ScreenConnect) 19.3.25270.7185 is affected by a CSRF issue that can be used to send API requests without user authorization. The root cause is CSRF in the web/API surface, enabling potentially unauthorized actions via forged requests. Concrete impact is partial to hi...

CVE-2019-16513: Cross-Site Request Forgery (CSRF)

An issue was discovered in ConnectWise Control formerly known as ScreenConnect 19.3.25270.7185. CSRF can be used to send API requests...

PT-2020-9829

Name of the Vulnerable Software and Affected Versions ConnectWise Control versions 19.3.25270.7185 Description An issue was discovered that allows Cross-Site Request Forgery CSRF to be used to send API requests. Recommendations For version 19.3.25270.7185, at the moment, there is no information...

Apache NiFi user log out issue

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out t...

GHSA-FMQW-VQH5-CWQ9 Apache NiFi user log out issue

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out t...