Security Bulletin: App Connect Professional & IBM WebSphere Cast Iron Solution are affected by axios vulnerability

Summary App Connect Professional & IBM WebSphere Cast Iron Solution have addressed the following vulnerability reported in axios. Vulnerability Details CVEID: CVE-2021-3749 DESCRIPTION: axios is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

Security Bulletin: App Connect Professional is affected by Bouncy Castle vulnerability.

Summary App Connect Professional have addressed the following vulnerability reported in Bouncy Castle. Vulnerability Details CVEID: CVE-2020-26939 DESCRIPTION: Legion of the Bouncy Castle BC and Legion of the Bouncy Castle BC-FJA could allow a remote attacker to obtain sensitive information, caus...

Adobe Connect 跨站请求伪造漏洞

Adobe Connect is a software used to create meeting environments by Adobe. Adobe Connect suffers from a cross-site request forgery vulnerability that stems from the software's lack of token authentication for cross-site request forgery, which can be exploited by an attacker to trigger an arbitrary...

APSB21-112 : Security update available for Adobe Connect

Adobe has released a security update for Adobe Connect. This update resolves an important vulnerability. Successful exploitation could lead to arbitrary file system write...

Session Fixation

express-openid-connect is vulnerable to session fixation. The attack exists because the library does not regenerate the session id and cookie when user logs in, allowing a malicious user to hijack the session using earlier generated cookies...

GHSA-7RG2-QXMF-HHX9 Session fixation in express-openid-connect

Overview Versions 2.3.0 up to and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Am I affected? You are affected by this vulnerability if you are using express-openid-connec...

Session fixation in express-openid-connect

Overview Versions 2.3.0 up to and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Am I affected? You are affected by this vulnerability if you are using express-openid-connec...

CVE-2021-39002

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2021-38931

IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not authorized to select from. IBM X-Force ID: 210418...

CVE-2021-41695

An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php...

CVE-2021-41695

An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php...

CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

CVE-2021-41246

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

Session fixation

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

CVE-2021-41246

Express OpenID Connect middleware for Express.js is affected. Versions up to and including 2.5.1 do not regenerate the session id and session cookie on login, enabling session-fixation risks. A patch exists in version 2.5.2, which fixes the issue. Several sources corroborate this behavior and pat...

CVE-2021-41246 Session fixation in express-openid-connect

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation...

Security Bulletin: IBM App Connect Enterprise v11 is affected by vulnerabilities in Node.js (CVE-2021-23358)

Summary IBM App Connect Enterprise v11 ships with Node.js for which vulnerabilities were reported and have been addressed. Vulnerability details are listed below. Vulnerability Details CVEID: CVE-2021-23358 DESCRIPTION: Node.js underscore module could allow a remote attacker to execute arbitrary...

connectchurchcc.com Improper Access Control vulnerability OBB-2297356

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Auth0 Express OpenId Connect 授权问题漏洞

Auth0 Express OpenId Connect is an open source component of Auth0 Inc. Express.js middleware used to protect the OpenID Connect web application. Auth0 Express OpenID Connect has an authorization issue vulnerability that stems from not regenerating the session ID and session cookie when a user log...