3718 matches found
UBUNTU-CVE-2023-3635
GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer. This may lead to denial of service of the Okio client when handling a crafted GZIP archive, by using the GzipSource class...
Debian dla-3494 : ruby-doorkeeper - security update
The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3494 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3494-1 [email protected] https://www.debian.org/lts/security/...
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : Doorkeeper vulnerability (USN-6210-1)
The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has a package installed that is affected by a vulnerability as referenced in the USN-6210-1 advisory. It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have been previou...
USN-6210-1: Doorkeeper vulnerability
It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have been previous approved. An attacker could potentially exploit these in order to impersonate another user and obtain sensitive information...
USN-6210-1 ruby-doorkeeper vulnerability
It was discovered that Doorkeeper incorrectly performed authorization checks for public clients that have been previous approved. An attacker could potentially exploit these in order to impersonate another user and obtain sensitive information...
JumpCloud Resets API Keys Amid Ongoing Cybersecurity Incident
JumpCloud, a provider of cloud-based identity and access management solutions, has swiftly reacted to an ongoing cybersecurity incident that impacted some of its clients. As part of its damage control efforts, JumpCloud has reset the application programming interface API keys of all customers...
JumpCloud Resets API Keys Amid Ongoing Cybersecurity Incident
JumpCloud, a provider of cloud-based identity and access management solutions, has swiftly reacted to an ongoing cybersecurity incident that impacted some of its clients. As part of its damage control efforts, JumpCloud has reset the application programming interface API keys of all customers...
CVE-2023-36539
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information...
CVE-2023-36539
Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information...
PT-2023-25618 · Zoom · Zoom
Name of the Vulnerable Software and Affected Versions: Zoom affected versions not specified Description: Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information. Recommendations: At the moment, there is no information about a newer...
Amazon Linux 2023 : openldap, openldap-clients, openldap-compat (ALAS2023-2023-219)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-219 advisory. A vulnerability was found in openldap that can cause a null pointer dereference in the bermemallocx function. CVE-2023-2953 Tenable has extracted the preceding description block directly from the tested...
keycloak: oauth client impersonation
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...
Exceeding the recursive-clients quota may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0
...
CVE-2023-32605
creationtimestamp| type| source ---|---|--- 2023-06-27 02:21:51+00:00| seen| https://t.me/cibsecurity/65536 2023-06-27 02:27:54+00:00| seen| https://t.me/cibsecurity/65564...
CVE-2023-32604
creationtimestamp| type| source ---|---|--- 2023-06-27 02:21:51+00:00| seen| https://t.me/cibsecurity/65536 2023-06-27 02:27:54+00:00| seen| https://t.me/cibsecurity/65564...
CVE-2023-2422
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to...
Debian DSA-5439-1 : bind9 - security update
The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5439 advisory. - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent to...
SUSE CVE-2023-2911
If the recursive-clients quota is reached on a BIND 9 resolver configured with both stale-answer-enable yes; and stale-answer-client-timeout 0;, a sequence of serve-stale-related lookups could cause named to loop and terminate unexpectedly due to a stack overflow. This issue affects BIND 9 versio...
CVE-2023-34462
CVE-2023-34462 affects Netty SniHandler: during TLS handshake, it can allocate up to 16 MB of heap per channel (ByteBuf from ClientHello) if no idle timeout is set, enabling a crafted ClientHello to trigger memory growth and DoS. The issue is fixed in Netty 4.1.94.Final. Remediation: upgrade Nett...
