WhatsApp introduces new security features

WhatsApp has announced several new security features which include an extra check when an account is transferred to a new device. This check asks that users confirm the transfer on their old device. This should warn users in case there is a transfer in progress started by somebody trying to hijac...

CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script...

CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script...

PT-2023-19918 · Ec Cube · Ec-Cube

Name of the Vulnerable Software and Affected Versions: EC-CUBE versions 4.0.0 through 4.0.6-p2 EC-CUBE versions 4.1.0 through 4.1.2-p1 EC-CUBE version 4.2.0 Description: A cross-site scripting issue in the Authentication Key Settings of EC-CUBE allows a remote authenticated attacker to inject an...

CVE-2023-25077

Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0 allows a remote authenticated attacker to inject an arbitrary script...

Multiple cross-site scripting vulnerabilities in EC-CUBE

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability in Contents Management CWE-79 - CVE-2023-22438 Cross-site scripting vulnerability in Authentication Key Settings CWE-79 - CVE-2023-25077 Cross-site...

K05405841: GCM nonce vulnerability CVE-2016-0270

Security Advisory Description IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce i...

SUSE CVE-2008-3526

Integer overflow in the sctpsetsockoptauthkey function in net/sctp/socket.c in the Stream Control Transmission Protocol sctp implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service panic or possibly have unspecified other impact via a...

The vulnerability of the authentication system for web applications, LemonLDAP::NG, related to an error in processing authentication keys, allows a perpetrator to gain unauthorized access to sensitive information.

The vulnerability of the authentication system for web applications in LemonLDAP::NG is related to security mechanism errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to information...

CVE-2022-40494

NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters...

CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...

DEBIAN-CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...

UBUNTU-CVE-2022-2553

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node to node. As a result, nodes that do not have the correct authentication key are not prevented from communicating with other nodes in the cluster...

ceph: Unauthorized global_id reuse in cephx

An authentication flaw was found in ceph. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated with another user, as ceph...

Use of a Broken or Risky Cryptographic Algorithm

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

Dovecot 路径遍历漏洞

Dovecot is an open source IMAP and POP3 mail server based on Linux/UNIX-like systems. A path traversal vulnerability exists in Dovecot versions prior to 2.3.15, where an attacker with privileged access to the local filesystem can trick OAuth2 authentication into using an HS256 authentication key...

ceph: Unauthorized global_id reuse in cephx

An authentication flaw was found in ceph. When the monitor handles CEPHXGETAUTHSESSIONKEY requests, it doesn't sanitize otherkeys, allowing key reuse. An attacker who can request a globalid can exploit the ability of any user to request a globalid previously associated with another user, as ceph...

ansible: user data leak in snmp_facts module

A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by nolog feature when using the snmpfacts module. Attackers could take advantage of this information to steal the SNMP credentials. The highest threat from this vulnerability is to data...

ansible: user data leak in snmp_facts module

A flaw was found in ansible. The 'authkey' and 'privkey' credentials are disclosed by default and not protected by nolog feature when using the snmpfacts module. Attackers could take advantage of this information to steal the SNMP credentials. The highest threat from this vulnerability is to data...

The vulnerability of the xAPI microprogramming software component of the Cisco TelePresence Collaboration Endpoint (CE) conference call control device and the Cisco RoomOS operating system allows a perpetrator to execute arbitrary code.

The vulnerability of the xAPI microprogramming software components of the Cisco TelePresence Collaboration Endpoint conference call management device and the Cisco RoomOS operating system is related to an error in the processing of authentication keys controlled by users. Exploiting this...