CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

646 matches found

Veracode•added 2017/08/03 5:10 a.m.•14 views

Session Fixation

keycloak-servlet-filter-adapter is vulnerable to session fixation attacks. The library does not assign a new session ID whenever a user authenticates, allowing a malicious user to reuse session IDs to impersonate another user...

6.6AI score

SaveExploits0

Tenable Nessus•added 2017/07/17 12:00 a.m.•29 views

Debian DSA-3909-1 : samba - security update (Orpheus' Lyre)

Jeffrey Altman, Viktor Duchovni and Nico Williams identified a mutual authentication bypass vulnerability in samba, the SMB/CIFS file, print, and login server. Also known as Orpheus' Lyre, this vulnerability is located in Samba Kerberos Key Distribution Center KDC-REP component and could be used ...

8.1CVSS7AI score0.05118EPSS

SaveExploits0References7

OpenVAS•added 2017/07/16 12:00 a.m.•33 views

Debian Security Advisory DSA 3912-1 (heimdal - security update)

Jeffrey Altman, Viktor Dukhovni, and Nicolas Williams reported that Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos, trusts metadata taken from the unauthenticated plaintext Ticket, rather than the authenticated and encrypted KDC response. A man-in-the-middle...

6.8CVSS6.9AI score0.05118EPSS

SaveExploits0References1

OpenVAS•added 2017/07/13 12:00 a.m.•35 views

Debian: Security Advisory (DSA-3909-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

8.1CVSS7.1AI score0.05118EPSS

SaveExploits0References5

FreeBSD•added 2017/07/12 12:00 a.m.•39 views

FreeBSD -- heimdal KDC-REP service name validation vulnerability

Problem Description: There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found in a ticket. Impact: An attacker who has control of the network between a client and the service it talks to will be able to impersona...

6.5CVSS6.7AI score0.00992EPSS

SaveExploits0

osv_cve•added 2017/06/13 6:29 a.m.•34 views

CVE-2017-2773

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token JWT libraries can allow unprivileged attackers to impersonate oth...

9.8CVSS6.8AI score

SaveExploits0References2

Hacker One•added 2017/04/05 8:33 p.m.•27 views

GitLab: Stored XSS on Files overview by abusing git submodule URL

Vulnerability description There's a stored Cross-Site Scripting XSS vulnerability in the Files overview of a project due to the incorrect handling of a git submodule. This allows an attacker to execute JavaScript in a visitor's session. Proof of concept To reproduce the issue, the attacker needs ...

0.2AI score

SaveExploits0