819 matches found
Certify - Active Directory Certificate Abuse
Certify is a C tool to enumerate and abuse misconfigurations in Active Directory Certificate Services AD CS. @harmj0y and @tifkin are the primary authors of Certify and the the associated AD CS research blog and whitepaper. Usage C:\ToolsCertify.exe / | | | / | | | | | | | | | / \ '| | | | | | | ...
Improper Authentication in Apereo CAS
Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication...
GHSA-Q39C-5VH5-VW2P Improper Authentication in Apereo CAS
Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication...
CVE-2021-3636
OpenShift OpenShift before 4.8 includes an in-cluster Service CA certificate that incorrectly contains additional CA certificates. This allows an attacker who compromising any of those extra CAs to masquerade as a trusted in-cluster service, enabling potential impersonation of in-cluster services...
Jenkins CAS Plugin Input Validation Error Vulnerability
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . An input validation error vulnerability exists in Jenkins CAS Plugin 1.6.0 and earlier versions, which stems from Jenki...
CVE-2021-21673
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2021-21673
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2021-21673
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
Design/Logic Flaw
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2021-21673
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2021-21673
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2021-21673
CVE-2021-21673 affects the Jenkins CAS Plugin up to version 1.6.0. The root cause is improper determination of a redirect URL after login, allowing phishing by redirecting users to an attacker-controlled site. Public disclosures (GHSA-2VVR-5757-QP87, OSV, NVD) note that Jenkins CAS Plugin 1.6.1 f...
CVE-2021-21673: Undefined Security Weakness
Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
Open redirect vulnerability in cas-plugin
cas-plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. cas-plugin 1.6....
HPE RDA-CAS 1.23.826 Denial Of Service Exploit
!/usr/bin/python -- coding: UTF-8 -- hpfreeze.py HPE Remote Device Access Unauthenticated Denial of Service Jeremy Brown jbrown3264/gmail June 2021 "Designed for the enterprise, HPE RDA Remote Device Access provides integrated remote connectivity for support automation, device telemetry and remot...
GeoGebra CAS Calculator 6.0.631.0 - Denial of Service Exploit
Exploit Title: GeoGebra CAS Calculator 6.0.631.0 - Denial of Service PoC Exploit Author: Brian Rodriguez Vendor Homepage: https://www.geogebra.org Software Link: https://www.geogebra.org/download Version: 6.0.631.0-offlinecas Tested on: Windows 8.1 Pro STEPS Open the program Calculadora CAS Run...
JFrog Artifactory < 6.23.1 Multiple Vulnerabilities
According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 6.23.1. It is, therefore, affected by multiple vulnerabilities: - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to...
Information Disclosure
cas-server-support-otp-mfa is vulnerable to information disclosure. The vulnerability exists as the user's secret key is sent as a GET parameter in an img tag when Google Authenticator is used...