289 matches found
TIBCO Security Advisory: December 6, 2022 - TIBCO Nimbus -CVE-2022-41559
TIBCO Nimbus Open Redirect Vulnerability Original release date: December 6, 2022 Lastrevised: --- CVE-2022-41559 Source: TIBCOSoftware Inc. Products Affected TIBCO Nimbus version 10.5.0 The following component is affected: Web Client Description The component listed above contains an easily...
The vulnerability of the AAD Handler component in the Nimbus JOSE + JWT Java library, due to insufficient data authentication checks, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the AAD Handler component in the Nimbus JOSE + JWT Java library is related to insufficient verification of data authenticity. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information by uploading...
The vulnerability of the Nimbus JOSE + JWT Java library, related to incorrect verification of the cryptographic signature, allows a perpetrator to influence the integrity of the information.
The vulnerability of the Nimbus JOSE + JWT Java library is related to an incorrect verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to influence the integrity of the information...
CVE-2022-24967
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...
CVE-2022-24967
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...
Cross site scripting
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...
Black Rainbow NIMBUS 跨站脚本漏洞
Black Rainbow NIMBUS is a sophisticated operating platform from Black Rainbow, Inc. which is used to manage an organization's data. A cross-site scripting vulnerability exists in Black Rainbow NIMBUS version 3.7.0 that stems from a stored cross-site scripting issue in multiple functions...
CVE-2022-24967
Black Rainbow NIMBUS has a stored XSS vulnerability tracked as CVE-2022-24967 affecting versions before 3.7.0; remediation is upgrade to 3.7.0. No exploitation details are provided in the connected documents.
CVE-2022-24967
Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting XSS...
MediaWiki Cross-Site Scripting Vulnerability (CNVD-2022-68884)
MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and prior versions, which stems from a cross-site...
GHSA-JFMQ-4G4M-99RH Nimbus JOSE+JWT vulnerable to padding oracle attack
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...
Nimbus JOSE+JWT vulnerable to padding oracle attack
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack...
GHSA-2QP9-WG27-9PCV Nimbus JOSE+JWT missing overflow check
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data AAD and ciphertext so that different plaintext is obtained for the same HMAC...
Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation...
Nimbus JOSE+JWT missing overflow check
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data AAD and ciphertext so that different plaintext is obtained for the same HMAC...
CVE-2022-29907
The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...
Design/Logic Flaw
The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...
CVE-2022-29907
The Nimbus skin for MediaWiki through 1.37.2 before 6f9c8fb868345701d9544a54d9752515aace39df allows XSS in Advertise link messages...
CVE-2022-29907
CVE-2022-29907 affects the Nimbus skin for MediaWiki up to 1.37.2, where the Advertise link messages are vulnerable to cross-site scripting. The issue arises before the patch referenced by commit 6f9c8fb868345701d9544a54d9752515aace39df, allowing XSS without specified exploitation details. Connec...