PT-2024-10232 · Drupal · Drupal Oauth & Openid Connect Single Sign On – Sso

Name of the Vulnerable Software and Affected Versions: Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client versions 3.0.0 through 3.43.0 Drupal OAuth & OpenID Connect Single Sign On – SSO OAuth/OIDC Client versions 4.0.0 through 4.0.18 Description: The issue is related to imprope...

Important: Red Hat Security Advisory: rhc-worker-playbook security update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

UBUNTU-CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Impact The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically...

GHSA-6943-QR24-82VX sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Impact The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically...

CVE-2024-52801 Brute force takeover of OpenID Connect session cookies in sftpgo

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

CVE-2024-52801 Brute force takeover of OpenID Connect session cookies in sftpgo

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

CVE-2024-52801

SFTPGo (CVE-2024-52801) is affected by an OpenID Connect cookie vulnerability in which authenticated users can brute-force session cookies due to predictably generated cookies via the xid library. The issue enables access to other users’ data and is addressed in version 2.6.4, where cookies are m...

PT-2024-9658 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.4.7 and earlier Adobe Connect version 12.6 Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. It can be exploited if an attacker convinces a victim to visit a URL referencing a...

PT-2024-9648 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.4.7 and earlier Adobe Connect version 12.6 Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability, which may allow an unauthenticated attacker to execute malicious JavaScript content...

PT-2024-9659 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.6, 11.4.7 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to malicious...

PT-2024-9660 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.6, 11.4.7 and earlier Description: The issue is related to a URL redirection vulnerability to an untrusted site, also known as an "Open Redirect". This could allow a remote attacker to bypass existing security...

PT-2024-9656 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.4.7 and earlier Adobe Connect version 12.6 Description: The issue is related to insufficient protection of the web page structure, allowing for a reflected Cross-Site Scripting XSS attack. If an attacker can convince...

kernel: mptcp: ensure snd_nxt is properly initialized on connect

In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure sndnxt is properly initialized on connect Christoph reported a splat hinting at a corrupted snduna: WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 mptcpcleanuna+0x4b3/0x620 net/mptcp/protocol.c:1005 Modules...

The vulnerability of Siemens SINEMA Remote Connect lies in its insufficient limit on authentication attempts, allowing attackers to obtain encrypted user credentials.

The vulnerability of Siemens SINEMA Remote Connect relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow a malicious actor to obtain encrypted user credentials remotely...

The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure, which are network access control tools, stems from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure network access control tools is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary co...

The vulnerability of the Firmware Update Handler component of the Siemens SINEMA Remote Connect server allows a hacker to gain increased privileges.

The vulnerability of the Firmware Update Handler component in Siemens SINEMA Remote Connect relates to the creation of temporary files with insecure permissions. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

The vulnerability of Siemens SINEMA Remote Connect arises from the use of incorrect authentication tokens due to unlimited distribution of resources, which can lead to service failures.

The vulnerability of Siemens SINEMA Remote Connect relates to the use of incorrect authentication tokens due to unlimited distribution of resources. Exploiting this vulnerability can allow a perpetrator to cause service failures...

The vulnerability of the network control tools Ivanti Connect Secure (previously Pulse Connect Secure) and Ivanti Policy Secure access, related to incorrect processing of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Ivanti Connect Secure previously Pulse Connect Secure and Ivanti Policy Secure access controls lies in the improper processing of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted request...