1848 matches found
Hard-Coded Key Used For Remember-me Token in Opencast
Impact The security configuration in etc/security/mhdefaultorg.xml enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring th...
GHSA-VMM6-W4CF-7F3X Authentication Bypass For Endpoints With Anonymous Access in Opencast
Impact Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me toke...
Authentication Bypass For Endpoints With Anonymous Access in Opencast
Impact Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me toke...
CVE-2020-5222
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...
CVE-2020-5222
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...
CVE-2020-5222
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...
Default credentials
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...
CVE-2020-5222
Opencast prior to 7.6 and 8.1 uses a remember-me cookie whose value is derived from a hash of the username, password, and a system key. If an attacker obtains a remember-me token from one server, they can access other servers that accept the same credentials without handling credentials. The issu...
CVE-2020-5222 Hard-Coded Key Used For Remember-me Token in OpenCast
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials...
me-contro-te-streaming-film.online Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1076649 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting...
Threat Analysis Unit (TAU) Technical Report: The Prospect of Iranian Cyber Retaliation
Several different events in the Middle East ME region have escalated in the last several weeks between Iran and the United States. After a series of military operations between the two countries, several alerts were released from the U.S. government of a potential for cyberattacks. Traditionally...
SQL Injection Vulnerability in me***.php file of Yunye CMS frontend
Yunye CMS is an enterprise website building system developed by Luoyang Yunye Information Technology Co. There is a SQL injection vulnerability in the me.php file in the frontend of Yunye CMS. Attackers can use the vulnerability to obtain sensitive information in the database...
The vulnerability of the Apache Shiro framework, related to the default use of the “remember me” configuration, allows attackers to compromise the integrity of cookies.
The vulnerability of the Apache Shiro framework is related to the default use of the “remember me” configuration. Exploiting this vulnerability allows a malicious actor to affect the integrity of cookie files...
SQL injection vulnerability exists in ne***.php page of website building system of Shanghai To-Mei Information Technology Co.
EarthWeb Shanghai To-Me Information Technology Co., Ltd. is dedicated to corporate or entrepreneurial image design and online business expansion services. A SQL injection vulnerability exists in the ne.php page of the website builder system of Shanghai To-Me Information Technology Co...
SQL injection vulnerability in me***.class.php file of Laikai e-commerce management system
Laike e-commerce management system is an open source e-commerce management system. Laike e-commerce management system me.class.php file SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information...
Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor
Mozilla is bumping up its bug bounty payouts and has added new websites and services – including the recently deployed Firefox Monitor– to its bug bounty program in hopes of attracting more researchers to sniff out vulnerabilities. The browser-maker is doubling bug bounty payouts for most of its...
Apache Shiro Input Validation Error Vulnerability
Apache Shiro is the United States Apache Apache Software Foundation for the implementation of authentication , authorization , encryption and session management of the Java security framework . An input validation error vulnerability in Apache Shiro versions prior to 1.4.2 can be exploited by an...
DEBIAN-CVE-2019-12422
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack...