SUSE-SU-2022:1680-1 Security update for curl

This update for curl fixes the following issues: - CVE-2022-27776: Fixed Auth/cookie leak on redirect bsc1198766 - CVE-2022-22576: Fixed OAUTH2 bearer bypass in connection re-use bsc1198614...

CVE-2022-28930

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml...

CVE-2022-28930

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml...

ERP-Pro SQL注入漏洞

ERP-Pro is a software based on SpringBoot 2.X framework, which aspires to build ERP+Production functionality that can be integrated and used with multiple systems such as OA, CRM, Knowledgebase and so on. A security vulnerability exists in ERP-Pro version 3.7.5, which can be exploited by an...

Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealmauthContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Reverse Proxy Auth Plugin 1.6.0 and newer n...

GHSA-M9J2-GRQF-FG26 Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealmauthContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Reverse Proxy Auth Plugin 1.6.0 and newer n...

GHSA-56P3-RRP4-2J82 Plone Open Redirection vulnerability via next parameter

The isURLInPortal method in the URLTool class in inportal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allowexternalloginsites filtering property, redirect users to...

GHSA-66X7-2R56-FJ77 Buildbot CRLF Injection

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

Buildbot CRLF Injection

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout via the redirect parameter. This affects other web sites in the same domain...

GHSA-3GG4-6HQG-2VJX Logstash Logs Sensitive Information

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials...

Infinispan Rest API Does Not Enforce Auth Constraints

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name...

Jenkins Assembla Auth Plugin stores credentials in plain text

Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

GHSA-WMQ3-24JM-M8XH Jenkins Assembla Auth Plugin stores credentials in plain text

Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Puppet Improper Access Control

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding...

Improper Input Validation in JGroups

JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backport...

PT-2022-13879 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 12.6 through 14.8.5 GitLab versions 14.9 through 14.9.3 GitLab versions 14.10 through 14.10.0 Description: An issue has been discovered in GitLab where the platform was not correctly authenticating a user who had a certain...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

CVE-2022-1388 POC for CVE-2022-1388 affecting multiple F5 prod...

Exploit for Missing Authentication for Critical Function in F5 Big-Ip_Access_Policy_Manager

F5 BIG-IP RCE exploitation CVE-2022-1388 POST 1: !p...

CVE-2022-27181

CVE-2022-27181 affects F5 BIG-IP APM when an access profile uses APM AAA NTLM Auth. Exploitation leads to increased internal resource utilization and potential DoS on the BIG-IP device. Affected branches and known vulnerable ranges include: BIG-IP APM 16.1.x (16.1.0–16.1.2, fixed in 16.1.2.2), 15...

CVE-2021-43163

A Remote Code Execution RCE vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW3.01B11P55 via the checkNet function in /cgi-bin/luci/api/auth...