GO-2022-0519 Improper validation of access tokens in github.com/flyteorg/flyteadmin

Improper validation of access tokens can permit use of expired tokens...

Insecure Session

github.com/flyteorg/flyteadmin is vulnerable to insecure session. The vulnerability exists in ValidateAccessToken function in resourceserver.go because the access token keys are not properly validated which allows an attacker to access the server using expired tokens...

FlyteAdmin 代码问题漏洞

FlyteAdmin is a control plane for Flyte open source. It is responsible for managing entities tasks, workflows, startup plans and managing workflow execution. A code issue vulnerability exists in FlyteAdmin versions prior to 1.1.30, which stems from the fact that authenticated users using an...

Cross-Site Request Forgery in Jenkins

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user...

UBUNTU-CVE-2021-3144

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

Saltstack SaltStack Salt 代码问题漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions prior to Salt 3002.5, which stems from the fact that eaut...

Red Hat Keycloak 访问控制错误漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An access control error vulnerability exists in Red Hat Keycloak before version 13.0.0, which originates from a user being able to access...

CVE-2019-10353

CVE-2019-10353 affects Jenkins up to version 2.185 and earlier, and Jenkins LTS up to 2.176.1 and earlier. The root cause is CSRF tokens that did not expire, enabling attackers who obtain tokens to bypass CSRF protection. The related in-document entries (e.g., JENKINS_2_186 and GHSA-HCXF-RQ72-H4R...

spacewalk: Insecure computation of authentication signatures during user authentication

It was found that Spacewalk did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...

Authentication Bypass

openstack-keystone is vulnerable to authentication bypass. Access to the web and network interfaces are permitted using chained tokens even after the linked tokens have expired, granting an attacker continued access to the openstack services...

Replay Attack

Keycloak Spring Security Integration is vulnerable to replay attacks. The SAML broker consumer endpoint fails to properly validate the expired tokens of SAML assertions, allowing an attacker to replay an old token to obtain a valid session...

DEBIAN-CVE-2014-5251

The MySQL token driver in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token...

PYSEC-2014-107

The MySQL token driver in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token...

PT-2014-2551 · Openstack · Python-Keystoneclient

Name of the Vulnerable Software and Affected Versions: python-keystoneclient versions prior to 0.2.4 Description: The issue allows remote authenticated users to retain use of a token after it has expired or use a revoked token once it expires, due to improper checking of expiry for PKI tokens...

Moderate: Red Hat Security Advisory: python-keystoneclient security and bug fix update

Updated python-keystoneclient packages that fix one security issue and multiple bugs are now available for Red Hat OpenStack 3.0 Grizzly Preview. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...