ClusterLabs Hawk Code Injection Vulnerability

Clusterlabs Crmsh is a command line software for GNU/Linux systems for high availability cluster management from the ClusterLabs Clusterlabs team. A code injection vulnerability exists in ClusterLabs Hawk 2.x through 2.3.0-x, which stems from a Ruby code injection in hawkremembermeid in the...

PT-2020-6817 · Clusterlabs +1 · Clusterlabs Hawk +1

Name of the Vulnerable Software and Affected Versions: ClusterLabs Hawk versions 2.3.0 through 2.3.0-15 Description: The issue in ClusterLabs Hawk is related to the hawk invoke binary, which is intended to be used as a setuid program, allowing the hacluster user to invoke certain commands as root...

The Global Hawk Drone Iran Shot Down Was a $220M Surveillance Monster

The Global Hawk can fly at an altitude of 55,000 feet and stay aloft for 30 hours straight...

hawk-remblokken.nl XSS vulnerability

Open Bug Bounty ID: OBB-697795 Description| Value ---|--- Affected Website:| hawk-remblokken.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidd...

Regular Expression Denial of Service in hawk

Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's. Recommendation Update to hawk version 4.1.1 or later...

GHSA-JCPV-G9RR-QXRC Regular Expression Denial of Service in hawk

Versions of hawk prior to 3.1.3, or 4.x prior to 4.1.1 are affected by a regular expression denial of service vulnerability related to excessively long headers and URI's. Recommendation Update to hawk version 4.1.1 or later...

cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks

It was found that Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMAC...

Code injection

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The CVE-2017-3156 issue concerns the OAuth2 Hawk and JOSE MAC validation in Apache CXF. The connected advisories identify a root cause: the MAC signature comparison is not performed in constant time, creating exposure to timing attacks. Affected CXF versions are before 3.0.13 and before 3.1.10 in...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Apache CXF Timing Attack Information Disclosure Vulnerability

Apache CXF is the United States Apache Apache Software Foundation, an open source Web services framework. A timing attack vulnerability exists in the Apache CXF OAuth2 Hawk and JOSE MAC authentication code, which allows remote attackers to submit a special request to obtain sensitive information...

CVE-2017-3156

It was found that Apache CXF OAuth2 Hawk and JOSE MAC Validation code is not using a constant time MAC signature comparison algorithm which may be exploited by some sophisticated timing attacks. It may only affect OAuth2 Hawk or JWT access tokens or JOSE JWS/JWE interceptors which depend on HMAC...

SUSE-SU-2016:2249-1 Security update for hawk

This update for hawk fixes the following issues: - Set Content-Security-Policy to frame-ancestors 'self' bsc984619 - Colocation: Fix NameError when creating 2-resource constraints bsc957369...

Hawk Denial of Service Vulnerability

Hawk is a set of HTTP authentication schemes that use Message Authentication Code MAC algorithms in order to provide cryptographic authentication of localized HTTP requests. A denial-of-service vulnerability exists in Hawk versions prior to 3.1.3 and 4.x prior to 4.1.1, which can be exploited by...

CVE-2016-2515

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service CPU consumption or partial outage via a long 1 header or 2 URI that is matched against an improper regular expression...

CVE-2016-2515

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service CPU consumption or partial outage via a long 1 header or 2 URI that is matched against an improper regular expression...

Input validation

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service CPU consumption or partial outage via a long 1 header or 2 URI that is matched against an improper regular expression...

CVE-2016-2515

CVE-2016-2515 affects Hawk in Node.js/npm deployments: Hawk before 3.1.3 and 4.x before 4.1.1 is vulnerable to a denial of service where an attacker can cause CPU exhaustion by sending an excessively long header or URI that matches an improper regular expression. Reported in multiple sources (GHS...

CVE-2016-2515

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service CPU consumption or partial outage via a long 1 header or 2 URI that is matched against an improper regular expression...

Space Hawk - Base64 encoded String, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Space Hawk published at the 'play' market has multiple vulnerabilities...