8581 matches found
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
Authorization
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
CVE-2020-13272
GitLab CVE-2020-13272 affects GitLab CE/EE versions 12.3 through 13.0.1, where the OAuth authorization code flow lacks verification checks. The root cause is missing verification in the OAuth flow, allowing an unverified user to complete the authorization code flow. Public details in connected do...
CVE-2020-13272
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
CVE-2020-13272
Removed by vendor...
This Week in Security News: Intel Says ‘Tiger Lake’ Will Drown Control-Flow Malware and New Phishing Campaign Targeting Office 365 Exploits Brand Names
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how the next generation of Intel mobile processors will include malware protection built into the chip. Also, read about a new...
CVE-2020-13272: Insufficient Verification of Data Authenticity
OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow...
PT-2020-13413 · Oauth +1 · Oauth +1
Name of the Vulnerable Software and Affected Versions: OAuth versions 12.3 through 13.0.1 Description: The issue concerns the OAuth flow missing verification checks, allowing an unverified user to use the OAuth authorization code flow. Recommendations: For versions 12.3 through 13.0.1, update to ...
Intel Adds Anti-Malware Protection in Tiger Lake CPUs
Intel’s upcoming class of mobile CPUs, code named “Tiger Lake,” will feature a long anticipated security layer, called Control-flow Enforcement Technology CET, which aims to protect against common malware attacks. CET protects against attacks on processors’ control flow, which refers to the order...
CVE-2020-8675
Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
CVE-2020-0527
Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...
CVE-2020-0527
Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...
CVE-2020-8675
The CVE-2020-8675 issue affects the Intel® Innovation Engine Build and Signing Tool prior to version 1.0.859. The root cause is insufficient control flow management in the firmware build and signing tool, which could let an unauthenticated user escalate privileges via physical access. Impact is e...
CVE-2020-8675
Insufficient control flow management in firmware build and signing tool for IntelR Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access...
CVE-2020-0527
Insufficient control flow management in firmware for some IntelR Data Center SSDs may allow a privileged user to potentially enable information disclosure via local access...
A survey of recent iOS kernel exploits
Posted by Brandon Azad, Project Zero I recently found myself wishing for a single online reference providing a brief summary of the high-level exploit flow of every public iOS kernel exploit in recent years; since no such document existed, I decided to create it here. This post summarizes origina...
The vulnerability of the BruteForceProtector component of the Keycloak identity and access management software allows a hacker to gain unauthorized access to protected information.
The software for managing identities and access control in Keycloak is vulnerable due to errors in configuring the “Conditional OTP Authentication Flow”. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP
A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...