CVE-2021-27098

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

PT-2021-17248

Name of the Vulnerable Software and Affected Versions: SPIRE versions prior to 0.8.5 SPIRE versions prior to 0.9.4 SPIRE versions prior to 0.10.2 SPIRE versions prior to 0.11.3 SPIRE versions prior to 0.12.1 Description: The issue arises from the improper normalization of the path provided throug...

CVE-2021-27098: Improper Certificate Validation

In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy Node API can result in the possible issuance of an X.509 certificate with a URI SAN for a SPIFFE ID that the agent is not authorized to...

idm:DL1 and idm:client security, bug fix, and enhancement update

bind-dyndb-ldap 11.3-1 - New upstream release - Resolves: rhbz1845211 ipa 4.8.7-12.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 4.8.7-12 - Require selinux sub package in the proper version Related: RHBZ1868432 - SELinux: do not double-define nodet and pkitomcatcertt...

openstack-keystone: OAuth1 request token authorize silently ignores roles parameter

A flaw was found in Keystone, where it inadvertently provided OAuth1 access tokens to every role assignment the creator had for a project, resulting in giving more permissions and escalated access in role assignments than intended. The greatest impact is on confidentiality...

XSS Vulnerability in Bole Card Issuance System of Zunyi Xintengda Information Technology Co.

Zunyi Xintengda Information Technology Co., Ltd. is a professional e-commerce operation and network marketing services company. Zunyi Xintengda Information Technology Co., Ltd. Bole card issuance system has an XSS vulnerability, which can be exploited by attackers to obtain sensitive information...

UBUNTU-CVE-2020-12692

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

CVE-2020-11014: Undefined Security Weakness

Electron-Cash-SLP before version 3.6.2 has a vulnerability. All token creators that use the "Mint Tool" feature of the Electron Cash SLP Edition are at risk of sending the minting authority baton to the wrong SLP address. Sending the mint baton to the wrong address will give another party the...

DEBIAN-CVE-2014-2901

wolfssl before 3.2.0 does not properly issue certificates for a server's hostname...

UBUNTU-CVE-2014-2901

wolfssl before 3.2.0 does not properly issue certificates for a server's hostname...

CVE-2014-2901

CVE-2014-2901 concerns wolfSSL versions prior to 3.2.0 that do not properly issue certificates for a server’s hostname. Multiple sources (NVD, OSV, OSV-UBUNTU, Debian/Ubuntu trackers, Nessus plugin reference) corroborate the issue description. The connected documents provide the core detail: the ...

CVE-2014-2901

wolfssl before 3.2.0 does not properly issue certificates for a server's hostname...

Primeo has an unspecified vulnerability

Primeo PEO is an Ether-based digital currency. An unspecified vulnerability exists in the 'doAirdrop' function of the smart contract implementation of Primeo PEO. An attacker could exploit the vulnerability to issue any number of virtual currencies...

CVE-2018-18425

CVE-2018-18425 concerns Primeo (PEO), an Ethereum token. The doAirdrop function does not enforce a correct relation between the airdropped amount and the token’s total supply, allowing the contract owner to issue arbitrary currency. This bypasses the hard cap written in the contract and can deval...

CVE-2018-18425: Use of Insufficiently Random Values

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

PT-2019-9590

Name of the Vulnerable Software and Affected Versions Primeo PEO smart contract implementation affected versions not specified Description The issue concerns the doAirdrop function in the smart contract implementation, which fails to validate the numerical relationship between the airdrop amount...

First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records

The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. NYSE:FAF leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records -- including bank account numbers and...

Information Disclosure

github.com/hashicorp/vault is vulnerable to information disclosure. The vulnerability exists as the in-memory cache that exists on performance standby nodes is not purged if a mount filter was used to exclude the secondary cluster. This allows an attacker to retrieve mount configuration data whic...

CVE-2018-15754 UAA can issue tokens across identity providers if users with matching usernames exist

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a tok...

Nine NAS Bugs Open LenovoEMC, Iomega Devices to Attack

Lenovo is warning of nine vulnerabilities rated “high” and impacting 20 separate network attached storage NAS devices sold by the company, including its LenovoEMC, Iomega and its Lenovo-branded NAS devices. By exploiting one of several command-injection vulnerabilities in the devices’ operating...