CVE-2023-32089

Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description...

CVE-2023-32089

Pega Platform (versions 8.1–8.8.2) is affected by a cross-site scripting (XSS) issue in the Pin description. The RISK and root cause are described across multiple connected sources (e.g., Red Hat, CNNVD, PrIon, PT- Security), consistently listing XSS as the vulnerability class and the deprecated/...

Pegasystem PEGA Platform Cross-Site Scripting Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from the US-based Pegasystem. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-time Decision Making and CRM Customer Relationship Management. A security vulnerabilit...

SUSE: Security Advisory (SUSE-SU-2023:4104-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4104-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

SUSE-SU-2023:4089-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2023-40660: Fixed a PIN bypass that could be triggered when cards tracked their own login state bsc1215762. - CVE-2023-40661: Fixed several memory safety issues that could happen during the card enrollment process using pkcs15-init bsc12157...

CVE-2023-45466

Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pinhost parameter in the WPS Settings...

Authentication Bypass

libopensc.so is vulnerable to Authentication Bypass. The vulnerability exists in the scpkcs15verifypin function of pkcs15-pin.c when a token or card is plugged into the system and authenticated by one process, but can be utilized for cryptographic operations by another process when an empty,...

CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

SUSE CVE-2023-40660

A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an empty zero-length pin is passed. This issue poses a security risk, particularly for OS logon/screen unlock a...

PT-2023-8909 · Opensc +8 · Opensc +8

Name of the Vulnerable Software and Affected Versions: OpenSC affected versions not specified Description: A flaw was found in OpenSC packages that allows a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operations in other processes when an...

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user...

CVE-2023-4096

Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea version 1.5.0.0, which exploitation could allow an attacker to perform a brute force attack on the emailed PIN number in order to change the password of a legitimate user...

ASB-A-268038643

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no addition...

Nextcloud: DNS pin middleware can be tricked into DNS rebinding allowing SSRF

A vulnerability was disclosed where the DNS pin middleware could be tricked into DNS rebinding, allowing SSRF...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2023-21235

In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...

CVE-2023-21235

In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio...

CVE-2023-21234

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no...