CVE-2022-48494

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized...

CVE-2022-48494

CVE-2022-48494: Several connected records identify this as a vulnerability in Huawei-based environments (HarmonyOS/EMUI) involving lax app identity verification in the pre-authorization function. The core issue: an attacker could exploit weak identity checks to have malicious apps become pre-auth...

CVE-2022-48494

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized...

CVE-2022-48496

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized...

CVE-2022-48496

Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized...

CVE-2022-48496

CVE-2022-48496 describes a vulnerability in Huawei HarmonyOS where lax app identity verification in the pre-authorization function can allow malicious apps to become pre-authorized. The issue, associated with a high impact score (CVSS v3.1: 7.5, HIGH; Attack Vector: Network; Privileges Required: ...

PT-2023-15824 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns lax app identity verification in the pre-authorization function. Successful exploitation allows malicious apps to become pre-authorized. Recommendations: At the...

PT-2023-15826 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue concerns a lax app identity verification in the pre-authorization function, which can be exploited to allow malicious apps to become pre-authorized. Recommendations: At the...

Siemens Mendix SAML Authentication Bypass Vulnerability

The Mendix SAML module allows you to authenticate users in cloud applications using SAML. The module can communicate with any identity provider that supports SAML 2.0 or Shibboleth. An authentication bypass vulnerability exists in Siemens Mendix SAML, which can be exploited by an attacker to bypa...

How Microsoft and Sonrai integrate to eliminate attack paths

Cloud development challenges conventional thinking about risk. A “perimeter” was always the abstraction that security teams could start from—defining their perimeter and exposing the cracks in firewalls and network access. With more and more infrastructure represented as ephemeral code, protectin...

How Microsoft and Sonrai integrate to eliminate attack paths

Cloud development challenges conventional thinking about risk. A “perimeter” was always the abstraction that security teams could start from—defining their perimeter and exposing the cracks in firewalls and network access. With more and more infrastructure represented as ephemeral code, protectin...

LDAP Active Directory - crossRef Enumeration

Binary data ldapenumcrossref.nbin...

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected...

Doorkeeper Improper Authentication vulnerability

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252section-8.6 the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously...

GHSA-7W2C-W47H-789W Doorkeeper Improper Authentication vulnerability

OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252section-8.6 the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously...

CVE-2023-34246

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot...

CVE-2023-34246

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot...

Information Exposure

Overview UmbracoCms.IdentityExtensions is a Code files & installation that enables easy extensibility points for ASP.Net Identity and the Umbraco back office. Affected versions of this package are vulnerable to Information Exposure. Client secrets are not required which may expose some endpoints ...

CVE-2023-32312

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

Authorization

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...