9653 matches found
CVE-2024-40627 OpaMiddleware does not filter HTTP OPTIONS requests
Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...
Cookie Tossing
Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...
CVE-2024-39912: Observable Response Discrepancy
web-auth/webauthn-lib is an open source set of PHP libraries and a Symfony bundle to allow developers to integrate that authentication mechanism into their web applications. The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found...
Malicious code in sap-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96e0e21ec4f22a89cdcbe949b1016299ac32d48a02f566abf8446943ec3e14b0 The OpenSSF Package Analysis project identified 'sap-auth' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2024-7678 Malicious code in sap-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96e0e21ec4f22a89cdcbe949b1016299ac32d48a02f566abf8446943ec3e14b0 The OpenSSF Package Analysis project identified 'sap-auth' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
Security Bulletin: Denial of service and security restrictions bypass might affect IBM Storage Defender – Resiliency Service
Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in data confidentiality and service availabilty issues. The vulnerabilities have been addressed. CVE-2024-27351, CVE-2024-34064, CVE-2024-32879, CVE-2024-24786. Vulnerability Details CVEID:CVE-2024-24786 DESCRIPTION:...
GLSA-202407-05 : SSSD: Command Injection
The remote host is affected by the vulnerability described in GLSA-202407-05 SSSD: Command Injection A vulnerability has been discovered in SSSD. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo Linux...
GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd
Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...
CVE-2024-28820: Out-of-bounds Read
Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...
CVE-2024-28820
Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...
CVE-2024-28820
The openvpn-auth-ldap (Three Rings Auth-LDAP plugin for OpenVPN) software, version 2.0.4 , is vulnerable to a buffer overflow in the extract_openvpn_cr function within the openvpn-cr.c file. An attacker with a valid LDAP username who can control the challenge/response password field can trigger t...
CVE-2024-28820
Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...
CVE-2024-28820
Buffer overflow in the extractopenvpncr function in openvpn-cr.c in openvpn-auth-ldap aka the Three Rings Auth-LDAP plugin for OpenVPN 2.0.4 allows attackers with a valid LDAP username and who can control the challenge/response password field to pass a string with more than 14 colons into this...
CVE-2024-38272 Auth Bypass in Quick Share
There exists a vulnerability in Quick Share/Nearby, where an attacker can bypass the accept file dialog on Quick Share Windows. Normally in Quick Share Windows app we can't send a file without the user accept from the receiving device if the visibility is set to everyone mode or contacts mode. We...
CVE-2024-38272
CVE-2024-38272 affects Google's Quick Share (Windows) where an attacker can bypass the Accept File dialog, enabling a transfer without recipient consent. The vulnerability is described as an auth bypass in Quick Share for Windows; the issue is fixed in version 1.0.1724.0 and later. Connected sour...
GO-2024-2947 Leak of sensitive information to log files in github.com/hashicorp/go-retryablehttp
URLs were not sanitized when writing them to log files. This could lead to writing sensitive HTTP basic auth credentials to the log file...
MAL-2024-6722 Malicious code in auth-client (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in auth-client (RubyGems)
--- -= Per source details. Do not edit below this line.=-...