14966 matches found
Privilege Escalation
Azure Identity and Microsoft Authentication are vulnerable to Privilege Escalation. The vulnerability is due to improper handling of tokens and keys within DefaultAzureCredential and ManagedIdentityCredential classes, allowing an attacker to elevate to SYSTEM privileges read arbitrary files on th...
Access Control Bypass
oauthenticator is vulnerable to Access Control Bypass. The vulnerability is due to the allowall setting taking precedence over identityprovider, allowing attackers to log in without restriction based on the intended institutional identity provider configuration...
Google Pixel Security Breach
Google Pixel is a smartphone from Google, Inc. in the United States. A security vulnerability exists in Google Pixel, which stems from a lack of bounds checking in the ProtocolCellIdentityParserV4::Parse module of protocolnetadapter.cpp, which may allow out-of-bounds reads...
Azure Identity SDK < 4.2.1
The version of Azure Identity installed on the remote host is prior to 4.2.1. It is, therefore, affected by a vulnerability: - Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-35255 Note that Nessus has not tested for this issue but has...
CVE-2024-5906
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
CVE-2024-5906
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...
CVE-2024-5906
The CVE concerns Palo Alto Networks Prisma Cloud Compute. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the web interface that is exploitable by a malicious administrator who has add/edit permissions for identity providers. The underlying issue allows the attacker to store a J...
CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
A cross-site scripting XSS vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to...
MAL-2024-1593 Malicious code in ato-z-web-identity-components-app-cdk-adp-wrapper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33c62d31d74de8fa6a7a3911507ce9a8d513bccb45ff1b51b7fbb9068920d3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-37237 · Palo Alto Networks · Palo Alto Networks Prisma Cloud Compute
Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Prisma Cloud Compute affected versions not specified Description: A cross-site scripting XSS issue allows a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the we...
OAuthenticator Security Vulnerability
OAuthenticator is an OAuth token library for the JupyerHub login handler. A security vulnerability exists in OAuthenticator version 16.3.0 and earlier, which stems from the fact that the allowall configuration item took precedence over the identityprovider configuration item starting in JupyterHu...
GHSA-M5VV-6R4H-3VJ9 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
@artusx/init (>=1.2.0-beta.1, <=1.2.1), @artusx/rush-utils (>=0.0.1, <=0.0.11) +20 more potentially affected by CVE-2024-35255 via @azure/identity (>=4.0.0, <=4.2.0)
@azure/identity NPM version =4.0.0, =1.2.0-beta.1, =0.0.1, =1.0.0-alpha.20231026.4, =1.0.1-alpha.20231026.4, =2.0.1, =1.19.0-beta.0, =5.112.0, =5.112.0, =0.9.11, =1.0.0, =1.0.1 and more Source cves: CVE-2024-35255 Source advisory: OSV:GHSA-M5VV-6R4H-3VJ9...
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Overview Affected versions of this package are vulnerable to Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' in the authentication process. An attacker can elevate privileges by exploiting race conditions during the token validation steps. This is only...