Malicious code in apollo-federation-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5201e2567b87839a5bb3c1c2dd4c7c9b275c284349ff04a9c2b348451b979206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1057 Malicious code in apollo-federation-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5201e2567b87839a5bb3c1c2dd4c7c9b275c284349ff04a9c2b348451b979206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-30584

Archer Platform 6.3 before 6.11 6.11.0.0 contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system. 6.10 P3 6.10.0.3 and 6.9 SP3 P4 6.9.3.4 are also fixed releases...

Archer Platform 安全漏洞

Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in Archer Platform versions 6.3 through 6.11 that stems from incorrect access control in the SSO ADFS functionality. A malicious user may be able to exploit this vulnerability to...

PT-2022-20189 · Rsa · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions 6.3 through 6.10 before 6.10.0.3 Archer Platform versions 6.9 through 6.9.3 before 6.9.3.4 Archer Platform versions prior to 6.11.0.0 Description: The issue is related to an Improper Access Control Vulnerability withi...

GHSA-CPPW-2MF8-QPM5 Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

GHSA-9PF7-F47Q-MWPQ Cross-site Scripting in RabbitMQ

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious use...

Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

com.coherentlogic.fred.client:fred-client-webstart-application (>=0.9.11 <=1.0.9-RELEASE), com.nimbusds:common (>=1.70 <=1.74) +116 more potentially affected by CVE-2013-4112 via org.jgroups:jgroups (>=3.3.0.CR1 <=3.3.2.Final)

org.jgroups:jgroups MAVEN version =3.3.0.CR1, =0.9.11, =1.70, =1.0, =1.5.1, =1.1, =1.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.5.0, =2.5.0, =2.5.0, =2.5.0, =2.5.3 and more Source cves: CVE-2013-4112 Source advisory: OSV:GHSA-CC62-496P-HRR7...

GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

GHSA-VMCC-4P4X-X7WG Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

GHSA-V8WM-G9F2-XJV4 Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...

Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...

OpenStack Identity service (keystone) Incorrect Authorization

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...

Russia to Rent Tech-Savvy Prisoners to Corporate IT?

Image: Proxima Studios, via Shutterstock. Faced with a brain drain of smart people fleeing the country following its invasion of Ukraine, the Russian Federation is floating a new strategy to address a worsening shortage of qualified information technology experts: Forcing tech-savvy people within...

allure-federation.fr Cross Site Scripting vulnerability OBB-2560374

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

FBI Shut Down Russia-linked "Cyclops Blink" Botnet That Infected Thousands of Devices

The U.S. Department of Justice DoJ announced that it neutralized Cyclops Blink, a modular botnet controlled by a threat actor known as Sandworm, which has been attributed to the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation GRU. "The operation...