3337 matches found
Moderate: Red Hat Security Advisory: mod_auth_openidc security update
An update for modauthopenidc is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
mod_auth_openidc: OIDC_CLAIM and OIDCAuthNHeader not skipped in an "AuthType oauth20" configuration
It was found that modauthopenidc did not properly sanitize HTTP headers for certain request paths. A remote attacker could potentially use this flaw to bypass authentication and access sensitive information by sending crafted HTTP requests...
CVE-2019-4284
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512...
PT-2019-17014 · Ibm · Ibm Cloud Private
Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 2.1.0, 3.1.0, 3.1.1, 3.1.2 Description: A local privileged user could obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. Recommendations: For IBM...
CVE-2018-20914
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
CVE-2018-20914
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
Command injection
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
CVE-2018-20914
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
CVE-2018-20914
CVE-2018-20914 affects cPanel before 70.0.23. OpenID providers can inject arbitrary data into cPanel session files (SEC-368), enabling manipulation of session state and potentially impacting the confidentiality and integrity of session data. Affected versions are cPanel prior to 70.0.23. Mitigati...
cPanel Input Validation Error Vulnerability (CNVD-2019-26365)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An input validation error vulnerability exists in versions of cPanel prior to 78.0.2. The vulnerability stems from a web-based...
PT-2019-10346
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 70.0.23 Description: The issue allows OpenID providers to inject arbitrary data into cPanel session files. Recommendations: For versions prior to 70.0.23, update to version 70.0.23 or later to resolve the issue...
CVE-2018-20914: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files SEC-368...
CVE-2019-14408
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
CVE-2019-14408
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
CVE-2019-14407
cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...
Design/Logic Flaw
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
Design/Logic Flaw
cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...
CVE-2019-14408
CVE-2019-14408 affects cPanel before 78.0.2. Affected component: the web-based cPanel interface; root cause described as an input validation issue that allows a demo account to link with an OpenID provider (SEC-460). Consequence: sanctioned links to an OpenID provider by a non-privileged/demo acc...