engine Trust Management Gaps

Internet Reservation Module Booking Engine is a booking platform. A trust management issue vulnerability exists in IRM Next Generation booking engine, which arises from the use of HMAC tokens to authenticate requests, but these tokens are exposed in JavaScript files loaded by the client...

twitch-tui's connection is not encrypted

Summary The connection is not using TLS for communication Details In the configuration of the irc connection, you are disabling tls which makes all communication to twitch irc servers unencrypted. PoC You can verify by using tcpdump/wireshark that traffic is unencrypted. Impact Communication can ...

A Data Exfiltration Attack Scenario: The Porsche Experience

As part of Checkmarx's mission to help organizations develop and deploy secure software, the Security Research team started looking at the security posture of major car manufacturers. Porsche has a well-established Vulnerability Reporting Policy Disclosure Policy1, it was considered in scope for...

U.S. Government Agencies' Emails Compromised in China-Backed Cyber Attack

An unnamed Federal Civilian Executive Branch FCEB agency in the U.S. detected anomalous email activity in mid-June 2023, leading to Microsoft's discovery of a new China-linked espionage campaign targeting two dozen organizations. The details come from a joint cybersecurity advisory released by th...

Microsoft Releases Updates to Patch Critical Flaws in Windows and Other Software

Microsoft has rolled out fixes for its Windows operating system and other software components to remediate major security shortcomings as part of Patch Tuesday updates for June 2023. Of the 73 flaws, six are rated Critical, 63 are rated Important, two are rated Moderate, and one is rated Low in...

CVE-2023-28084

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens...

CVE-2023-28084

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens...

Authentication flaw

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens...

CVE-2023-28084 HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens...

CVE-2023-28084

CVE-2023-28084 concerns HPE OneView and HPE OneView Global Dashboard appliances. The connected sources confirm that a device dump could expose authentication tokens, constituting a confidentiality impact described as high. The affected components are HPE OneView and HPE OneView Global Dashboard a...

CVE-2023-28084 HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens...

HPE OneView和HPE OneView Global Dashboard 安全漏洞

Hewlett Packard Enterprise OneView Global Dashboard OVGD and Hewlett Packard Enterprise OneView are both products of Hewlett Packard Enterprise, a U.S.-based company. Hewlett Packard Enterprise OneView Global Dashboard is a dashboard solution, and Hewlett Packard Enterprise OneView is software th...

PT-2023-21543 · Hewlett Packard · Hpe Oneview +1

Name of the Vulnerable Software and Affected Versions: HPE OneView and HPE OneView Global Dashboard appliance affected versions not specified Description: The issue concerns HPE OneView and HPE OneView Global Dashboard appliance dumps potentially exposing authentication tokens. There is no...

CVE-2022-48307

It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack...

SUSE CVE-2018-20170

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an...

SUSE CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

SUSE CVE-2020-7021

Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emitrequestbody option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch...

SUSE CVE-2021-3144

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

SUSE CVE-2021-43532

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that triggered authentication flows - in conjunction with a Content Security Policy that stopped a redirection chain in the middle - the final image URL could be one that contained an...

SUSE CVE-2022-31130

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with...