Essity: Privilege-relevant fields are clientModify in SAP CDC schema allowing role escalation to Admin

A vulnerability was discovered in the Gigya/SAP CDC tenant that allowed authenticated users to escalate their privileges to the Admin role. This was possible because critical fields such as "data.role" and "data.org.roles.name" had "writeAccess":"clientModify" permissions, allowing users to modif...

EUVD-2012-2119

Malware in sbrugna...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41210

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random numbers. This can lead to information disclosure and modification of certain user settings...

Information disclosure

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

PT-2022-6162

Name of the Vulnerable Software and Affected Versions SAP Customer Data Cloud Gigya mobile app for Android version 7.4 Description The issue is related to the use of an insecure random number generator program, which makes it easy for an attacker to predict future random numbers. This can lead to...

CVE-2022-41209

CVE-2022-41209 affects SAP Customer Data Cloud (Gigya) mobile app for Android, version 7.4. The issue is an encryption implementation with insufficient diffusion that can reveal patterns, enabling information disclosure; in some scenarios, replay attacks may also be possible. The available docume...

CVE-2022-41209: Inadequate Encryption Strength

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2022-41210: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses insecure random number generator program which makes it easy for the attacker to predict future random numbers. This can lead to information disclosure and modification of certain user settings...

CVE-2022-41210

CVE-2022-41210 affects SAP Customer Data Cloud (Gigya mobile app for Android) version 7.4. The issue is caused by an insecure random number generator, making it easy to predict future random numbers and enabling information disclosure and modification of certain user settings. Sources across mult...

CVE-2022-41209

SAP Customer Data Cloud Gigya mobile app for Android - version 7.4, uses encryption method which lacks proper diffusion and does not hide the patterns well. This can lead to information disclosure. In certain scenarios, application might also be susceptible to replay attacks...

CVE-2012-2117

Cross-site scripting XSS vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2117

Cross-site scripting XSS vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-2117

The CVE concerns the Gigya - Social optimization module for Drupal 6.x (prior to 6.x-3.2). The vulnerability arises from insufficient escaping of URL elements printed back to the user, enabling cross-site scripting (XSS). Affected software is the Gigya module for Drupal 6.x versions before 6.x-3....

CVE-2012-2117: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2012-3817

Name of the Vulnerable Software and Affected Versions Gigya - Social optimization module versions prior to 6.x-3.2 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This can be achieved via unspecifi...

SA-CONTRIB-2012-061 - Gigya - Social optimization - Cross Site Scripting (XSS)

CVE: CVE-2012-2117 The Gigya - Social optimization module provides a single API that aggregates authentication and social APIs from Facebook Connect, MySpace ID, Twitter, and OpenID webmail providers including Google, Yahoo, and AOL. The module doesn't sufficiently escape URL elements which are...