GHSA-G4RF-PC26-6HMR OMERO webclient does not validate URL redirects on login or switching group.

Background OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified i...

Linux: SSH StrictModes

StrictModes: Specifies whether sshd should check file modes and ownership of the user SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Ring Makes 2-Factor Authentication Mandatory Following Recent Hacks

Smart doorbells and cameras bring a great sense of security to your home, especially when you're away, but even a thought that someone could be spying on you through the same surveillance system would shiver up your spine. Following several recent reports of hackers gaining access to people's...

CVE-2013-1422

CVE-2013-1422 affects webCalendar (WebCalendar) prior to version 1.2.7. The flaw is that failed-login responses leak the reason (e.g., “no such user”), enabling user enumeration by an attacker via authentication attempts. The vulnerability is tied to the login error messaging rather than a fully ...

CVE-2013-2198

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

Design/Logic Flaw

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

CVE-2013-2198

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

CVE-2013-2198

The CVE-2013-2198 entry concerns Drupal’s Login Security module (6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3) where attackers can bypass intended restrictions by supplying a crafted username. The underlying issue is an incorrect use of string filtering in the module which can cause it t...

CVE-2013-2198

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

PT-2020-7385

Name of the Vulnerable Software and Affected Versions: Login Security module versions 6.x-1.x before 6.x-1.3 Login Security module versions 7.x-1.x before 7.x-1.3 Description: The issue allows attackers to bypass intended restrictions via a crafted username. Recommendations: For versions 6.x-1.x...

CVE-2013-2198: Incorrect Authorization

The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows attackers to bypass intended restrictions via a crafted username...

Sybase ASE Login Possible

Binary data sybaselogin.nbin...

CVE-2019-19021

An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account with a hard-coded password in the web administration interface, with administrator privileges. Anybody can log in with this account...

CVE-2019-8118

Summary: CVE-2019-8118 affects Magento 2.1 (pre-2.1.19), 2.2 (pre-2.2.10), and 2.3 (pre-2.3.3) where failed login attempts for customer accounts are stored using a weak cryptographic function. Impact (as described): The vulnerability arises from the weak crypto used for storing failed login attem...

Important: Red Hat Security Advisory: sudo security update

An update for sudo is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

PT-2019-4354 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions 0.9.8.838 through 0.9.8.846 Description: The issue is related to a weakness in the authentication procedure of the CentOS Web Panel, allowing remote attackers to bypass authentication in the login process by leveragi...

PhreeBooks ERP 5.2.3 - Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: PhreeBooks ERP 5.2.3 - Remote Command Execution Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://www.phreesoft.com/ Software Link: https://sourceforge.net/projects/phreebooks/ Version: v5.2.3 Category:...

HTTP session fixation vulnerability in SAML Plugin

SAML Plugin did not invalidate the previous session and create a new one upon successful login, allowing attackers able to control or obtain another user's pre-login session ID to impersonate them. SAML Plugin now invalidates the previous session during login and creates a new one...

avdbs.com XSS vulnerability

Open Bug Bounty ID: OBB-462957 Description| Value ---|--- Affected Website:| avdbs.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2017-19224 · Sma Solar Technology · Sunny Boy Tlst-21 +2

Name of the Vulnerable Software and Affected Versions: SMA Solar Technology products, specifically Sunny Boy TLST-21, TL-21, and Sunny Tripower TL-10, TL-30 Description: An issue in SMA Solar Technology products allows determination of active and inactive user accounts by sending crafted packets ...