Cloudflare OctoRPKI 安全漏洞

Cloudflare OctoRPKI is an RPKI toolkit for the Cloudflare platform from Cloudflare, Inc. in the United States. A security vulnerability exists in Cloudflare OctoRPKI. An attacker exploiting this vulnerability could create an overly long CA chain, causing OctoRPKI to exceed its maximum iteration...

Xiaomi specific devices 安全漏洞

Xiaomi specific devices are a series of specific devices from the Chinese company Xiaomi. A security vulnerability exists in Xiaomi specific devices, which stems from an authentication failure. An attacker could exploit this vulnerability to gain a short-lived elevation of privilege...

[Citrix VPN] Citrix Secure Access Client for MacOS gets error: "Error while processing request"

When connecting Citrix VPN from the latest Citrix Secure Access Client for MacOS, you may see the following error message before login: Error while processing request. Contact your administrator. Errors in client logs: Jul 6, 2022 at 9:43:32 AM GMT+9 : No certificate extension matching Subject...

Airspan AirSpot 5410 跨站脚本漏洞

The Airspan AirSpot 5410 is an advanced LTE, CAT12, outdoor, multi-service product from Airspan USA. A security vulnerability exists in Airspan AirSpot 5410 version 0.3.4.1-4 and prior versions, which stems from a failure of its binary component /home/www/cgi-bin/login.cgi to check that the user ...

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transmission between devices and applications allows a perpetrator to gain unauthorized access to the system.

The vulnerability of the OAS Engine SecureAddSecurity function in the platform for data transfer between devices and applications in the OAS Platform is related to the lack of authentication for this critical function. Exploiting this vulnerability could allow an attacker operating remotely to ga...

[CEM] MAM enrollment Fails in Authentication - Password window pops-up Repeatedly

When you enroll MAM to CEM server through Citrix Gateway, you may observe password box pops-up repeatedly without any error. It means your password is correct but SSO from Citrix Gateway to CEM server fails. Follow is the sample of Secure Hub's debug log. " 2022-06-22T14:50:06.638+0800 ",,DEBUG1...

GHSA-4XW6-HJ5P-4J79 OpenStack Glance sensitive information disclosure via logs

OpenStack Image Registry and Delivery Service Glance 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading th...

CVE-2022-1398

The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks...

WIZPLAT PD065 安全漏洞

WIZPLAT PD065 is a fingerprint-aware secure USB memory from WIZPLAT Korea.A denial of service vulnerability exists in WIZPLAT PD065 v1.19, which stems from a failure to properly verify authentication in the authentication module. An attacker could use this vulnerability to access sensitive data a...

The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications lies in the lack of authentication for critical functions, which allows a malicious actor to disable certain services.

The vulnerability of the PTC Axeda platform for creating and deploying corporate-level applications is related to the lack of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor to disable certain services by sending specially crafted commands remote...

DEBIAN-CVE-2022-0996

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication...

CVE-2021-27464

CVE-2021-27464 affects Rockwell Automation FactoryTalk AssetCentre (ArchiveService.rem) on v10.00 and earlier, where functions lack proper authentication, enabling a remote, unauthenticated attacker to execute arbitrary SQL statements. Connected sources corroborate a broader set of SQL/command-in...

java-11-openjdk bug fix and enhancement update

The java-11-openjdk packages provide the OpenJDK 11 Java Runtime Environment and the OpenJDK 11 Java Software Development Kit. Bug Fixes: The previous OpenJDK 11 release, 11.0.14, was found to contain a regression introduced by improvements to the HTTP client. It caused both the :authority' and...

Security update for cyrus-sasl (important)

openSUSE Security Update: Security update for cyrus-sasl Announcement ID: openSUSE-SU-2022:0743-1 Rating: important References: 1194265 1196036 Cross-References: CVE-2022-24407 CVSS scores: CVE-2022-24407 NVD : 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-24407 SUSE: 8.8...

GHSA-JP3M-VH3G-6GGP Liferay Portal and Liferay DXP fails to properly import users from LDAP

Security LDAP Implementation before 2.0.16 from Liferay Portal through v7.2.1 and Liferay DXP through v7.2 does not correctly import users from LDAP, allowing remote attackers to prevent a legitimate user from authenticating by attempting to sign in as a user that exists in LDAP...

Secure Hub fails to authenticate with Citrix Gateway 13.0 83.27 when using an Advanced Authentication policy for LDAP

Secure Hub shows the following error when trying to connect to Citrix Gateway: "You may need to contact your administrator to verify your sign-on credentials". Closer inspection of network traffic through Citrix Gateway shows that there is no 'Set-Cookie' response found in the reply to "GET...

CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR Insecure Direct Object Reference vulnerability...

HP Support Assistant 授权问题漏洞

HP Support Assistant is a solution from Hewlett-Packard HP that provides support and other functions for PCs and printers. HP Support Assistant has an authorization issue vulnerability that stems from the product's failure to effectively authenticate users, which could be exploited by an untruste...

HP Support Assistant 授权问题漏洞

HP Support Assistant is a solution from Hewlett-Packard HP that provides support and other functions for PCs and printers. HP Support Assistant is vulnerable to authorization issues, which stem from the product's failure to effectively authenticate users, and can be exploited by attackers to...

kyma 输入验证错误漏洞

kyma is an open source platform for scaling applications using microservices and serverless functionality. kyma suffers from an elevation-of-privilege vulnerability that stems from a networked system or product that does not properly authenticate incoming data. An authenticated attacker could...