python: wrong backtracking in urllib.request.AbstractBasicAuthHandler allows for a ReDoS

An uncontrolled resource consumption vulnerability was discovered in python in the class AbstractBasicAuthHandler, due to the kind of regular expression used while handling an authentication request in the httperrorauthreqed method. Client applications that use, directly or indirectly,...

CVE-2020-0837: Undefined Security Weakness

An elevation of privilege vulnerability exists when Active Directory Federation Services ADFS improperly handles multi-factor authentication requests. An attacker who successfully exploited this vulnerability could bypass some, but not all, of the authentication factors. To exploit this...

CVE-2020-1509

An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service LSASS when an authenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause an elevation of privilege on the targ...

CVE-2020-1509: Undefined Security Weakness

An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service LSASS when an authenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause an elevation of privilege on the targ...

Microsoft Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Microsoft Local Security Authority Subsystem Service is one of the local security...

Microsoft Windows Local Security Authority Subsystem Service Denial of Service Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A denial of service vulnerability exists in the Microsoft Windows Local Security Authority...

Design/Logic Flaw

This security update corrects a denial of service in the Local Security Authority Subsystem Service LSASS caused when an authenticated attacker sends a specially crafted authentication request, aka 'Local Security Authority Subsystem Service Denial of Service Vulnerability'...

Local Security Authority Subsystem Service Denial of Service Vulnerability

This security update corrects a denial of service in the Local Security Authority Subsystem Service LSASS caused when an authenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause a denial of service on the...

CVE-2020-1267: Undefined Security Weakness

This security update corrects a denial of service in the Local Security Authority Subsystem Service LSASS caused when an authenticated attacker sends a specially crafted authentication request, aka 'Local Security Authority Subsystem Service Denial of Service Vulnerability'...

CVE-2020-14049

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this...

PT-2020-13864

Name of the Vulnerable Software and Affected Versions Viber for Windows versions up to 13.2.0.39 Description The issue arises from Viber for Windows not properly quoting its custom URI handler, allowing a malicious website to launch Viber with arbitrary parameters. This could force a victim to se...

CVE-2020-1178

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka 'Microsoft SharePoint Server Elevation of Privilege Vulnerability'...

Privilege escalation

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka 'Microsoft SharePoint Server Elevation of Privilege Vulnerability'...

PT-2020-2753

Name of the Vulnerable Software and Affected Versions Microsoft SharePoint Server affected versions not specified Description The issue is related to an elevation of privilege vulnerability. It occurs when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication...

CVE-2020-1178: Undefined Security Weakness

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka 'Microsoft SharePoint Server Elevation of Privilege Vulnerability'...

PayPal: Token leak in security challenge flow allows retrieving victim's PayPal email and plain text password

A bug was identified whereby sensitive, unique tokens were being leaked in a JS file used by the recaptcha implementation. In certain cases, a user must solve a CAPTCHA challenge after authenticating. When the security challenge is completed, the authentication request is replayed to log in. The...

Security feature bypass

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'...

CVE-2019-1384

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability, an attacker could send a specially crafted authentication request, aka 'Microsoft Windows Security Feature Bypass Vulnerability'...

Insecure Random Number Generation

pac4j-saml uses an insecure random number generation. It generates entity ID with predictable randomness for SAML2 Authentication Request as it relies on random numbers generated using an insecure RandomStringUtils PRNG algorithm from apache commons-lang3 RandomStringUtil class...

PT-2019-4496

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.3 Description The issue is related to insufficient input validation and incorrect implementation of functions in the Linux kernel. It can be exploited by a remote attacker to cause a denial-of-service by sendin...