6857 matches found
GHSA-9WGG-M99Q-HHFC Expired tokens can be renewed without validating the account password
Impact In versions of the proxy from 2022-09-05 onwards since 8c874c2ff3d503ac20c7d32f46e08547fcb9e23f, expired OAuth 2.0 client credentials grant CCG flow authorisation tokens could be renewed automatically without checking their validity against the original account configuration i.e., the...
VED-eBPF - Kernel Exploit And Rootkit Detection Using eBPF
VED Vault Exploit Defense-eBPF leverages eBPF extended Berkeley Packet Filter to implement runtime kernel security monitoring and exploit detection for Linux systems. Introduction eBPF is an in-kernel virtual machine that allows code execution in the kernel without modifying the kernel source...
The vulnerability of the WebSocket technology in the Quarkus Java framework allows attackers to gain unauthorized access to protected information and enhance their privileges.
The vulnerability of the WebSocket technology in the Quarkus Java framework is related to the improper implementation of the sequence of actions performed during request processing, due to insufficient access control. Exploiting this vulnerability can allow an attacker to gain unauthorized access...
ProLion CryptoSpike Security Vulnerability
ProLion CryptoSpike is ProLion's solution for detecting and combating suspicious activity. A security vulnerability exists in ProLion CryptoSpike version 3.0.15P2 that stems from a lack of authentication in the internal data flow system...
Always-Incorrect Control Flow Implementation
OpenZeppelin is vulnerable to Always-Incorrect Control Flow Implementation. The vulnerability is due to the duplication of functionDelegateCall in the Multicall.sol file. This could lead to Unintended Duplicate Operations...
CVE-2022-39222
A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The...
materialflowsystems.com Improper Access Control vulnerability OBB-3804891
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
quarkus-oidc: ID and access tokens leak via the authorization code flow
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...
The vulnerability of Intel Optane solid-state storage’s microprogramming software, related to the implementation of incorrect control flow, allows a hacker to trigger a service failure.
The vulnerability of Intel Optane solid-state storage’s microprogramming software is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...
Buffer Overflow
gcc is vulnerable to Buffer Overflow. The vulnerability is caused due to fstack-protector feature in GCC-based toolchains that target AArch64 architecture which has an existing buffer overflow flaw in dynamically-sized local variables without being detected. An attacker can exploit this without...
BD FACSChorus Security Breach
The BD FACSChorus is a multichannel flow cytometry system from BD Medical BD. A security vulnerability exists in the BD FACSChorus that stems from not restricting which devices can interact with its USB port...
BD FACSChorus Security Breach
The BD FACSChorus is a multichannel flow cytometry system from Bidi Medical BD. A security vulnerability exists in the BD FACSChorus that stems from not blocking physical access to its PCI Express PCIe slot...
BD FACSChorus Security Breach
BD FACSChorus is a multichannel flow cytometry system from Bidi Medical BD. A security vulnerability exists in the BD FACSChorus that stems from being configured to allow the transmission of hashed user credentials based on a user action without fully verifying the identity of the requested...
CVE-2023-48228 OAuth2: PKCE can be fully circumvented
authentik is an open-source identity provider. When initialising a oauth2 flow with a codechallenge and codemethod thus requesting PKCE, the single sign-on provider authentik must check if there is a matching and existing codeverifier during the token step. Prior to versions 2023.10.4 and 2023.8....
PT-2023-30745
Name of the Vulnerable Software and Affected Versions authentik versions prior to 2023.8.5 authentik versions prior to 2023.10.4 Description The issue concerns the implementation of the Proof Key for Code Exchange PKCE in authentik, an open-source identity provider. When initializing an OAuth2 fl...
PT-2023-7321 · Owncloud · Owncloud
Name of the Vulnerable Software and Affected Versions: ownCloud owncloud/oauth2 versions prior to 0.6.1 Description: The issue is related to the "Allow Subdomains" configuration in the OAuth2 authorization platform, which is associated with access control weaknesses. An attacker can exploit this ...
The vulnerability of Zoom’s video conferencing software, related to the implementation of incorrect control flow, allows attackers to gain access to protected information.
The vulnerability of Zoom video conferencing software is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected information...
A deep dive into Phobos ransomware, recently deployed by 8Base group
Cisco Talos has recently observed an increase in activity conducted by 8Base, a ransomware group that uses a variant of the Phobos ransomware and other publicly available tools to facilitate their operations. Most of the groups Phobos variants are distributed by SmokeLoader, a backdoor trojan. Th...
