mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

Important: Red Hat Security Advisory: mod_auth_openidc:2.3 security update

An update for the modauthopenidc:2.3 module is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

SUSE CVE-2025-22109

In the Linux kernel, the following vulnerability has been resolved: ax25: Remove broken autobind Binding AX25 socket by using the autobind feature leads to memory leaks in ax25connect and also refcount leaks in ax25release. Memory leak was detected with kmemleak:...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:4128)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:4128 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2025:3997)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3997 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

CVE-2025-3838 Improper Authorization in the installer for the EOL OVA based connect component

An Improper Authorization vulnerability was identified in the EOL OVA based connect component which is deployed for installation purposes in the customer internal network. Under certain conditions, this could allow a bad actor to gain unauthorized access to the local db containing weakly hashed...

PT-2025-17430 · Unknown · Ova Based Connect

Name of the Vulnerable Software and Affected Versions: VMware End of Life OVA Connect versions prior to the end of support in January 2024 Description: An improper input validation vulnerability is identified in the End of Life EOL OVA based connect component, which is deployed for installation...

PT-2025-17432 · Unknown · Ova Connect Installer

Name of the Vulnerable Software and Affected Versions: OVA Connect Installer affected versions not specified Description: An improper neutralization of input issue was identified in the End of Life EOL OVA based connect installer component. This component was deprecated in September 2023 with end...

RHEL 9 : mod_auth_openidc (RHSA-2025:3945)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:3945 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connec...

Establishing Workload Identity for Zero Trust CI/CD: from Secrets to SPIFFE-Based Authentication

CI/CD systems have become privileged automation agents in modern infrastructure, but their identity is still based on secrets or temporary credentials passed between systems. In enterprise environments, these platforms are centralized and shared across teams, often with broad cloud permissions an...

curl: Buffer Overflow in curl MQTT Test Server (tests/server/mqttd.c) via Malicious CONNECT Packet

Title: Buffer Overflow in curl MQTT Test Server mqttd.c via Malicious CONNECT Packet Description The MQTT test server mqttd.c in the curl project contains a buffer overflow vulnerability due to improper validation of password length fields in MQTT CONNECT packets. An attacker can craft a maliciou...

CVE-2024-49808

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions...

CVE-2024-45651

IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system...

OESA-2025-1443 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Par...

OESA-2025-1445 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Par...

OESA-2025-1442 mod_auth_openidc security update

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying PartyRP to an OpenID Connect ProviderOP. Security Fixes: modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Par...

IBM Sterling Connect:Direct Web Services 代码问题漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A code issue vulnerability exists in IBM Sterling Connect:Direct Web Services that stems from a browser closing without disabling the session, no details of the...

PT-2025-17293 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.1.0 through 6.3.0 Description: The issue allows an authenticated user to spoof the identity of another user due to improper authorization, which could enable the user to bypass access...

IBM Sterling Connect:Direct Web Services 安全漏洞

IBM Sterling Connect:Direct Web Services is a file-based, peer-to-peer file transfer solution from International Business Machines IBM. A security vulnerability exists in IBM Sterling Connect:Direct Web Services versions 6.1.0, 6.2.0, and 6.3.0 that stems from improper authorization and could...

CVE-2025-32439

pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versions before 0.16.0, these scripts were spawned without proper process cleanup, leaving zombie processes in the system's process table. Even...