7661 matches found
CVE-2023-44040
In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting XSS vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate...
OpenID Connect client Atom Exhaustion in provider configuration worker ets table location
Impact DOS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited. Details Example to...
GHSA-MJ35-2RGF-CV8P OpenID Connect client Atom Exhaustion in provider configuration worker ets table location
Impact DOS by Atom exhaustion is possible by calling oidccproviderconfigurationworker:getproviderconfiguration/1 or oidccproviderconfigurationworker:getjwks/1. Since the name is usually provided as a static value in the application using oidcc, this is unlikely to be exploited. Details Example to...
CVE-2023-44040
In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting XSS vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate...
PT-2024-13167 · Veridium · Veridiumid
Name of the Vulnerable Software and Affected Versions: VeridiumID versions prior to 3.5.0 Description: The issue allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack on the identity provider page. Recommendations: For versions prior to...
CVE-2023-44038
CVE-2023-44038 affects VeridiumID prior to 3.5.0, where the identity provider page is vulnerable to an LDAP injection that allows an unauthenticated attacker to enumerate information about registered users. Affected product: VeridiumID (versions before 3.5.0). Root cause: LDAP injection on the id...
PT-2024-23852
Name of the Vulnerable Software and Affected Versions oidcc versions prior to 3.0.2 oidcc versions prior to 3.1.2 oidcc versions prior to 3.2.0-beta.3 Description A Denial of Service DoS by Atom exhaustion is possible by calling oidcc provider configuration worker:get provider configuration/1 or...
PT-2024-13169 · Veridium · Veridiumid
Name of the Vulnerable Software and Affected Versions: VeridiumID versions prior to 3.5.0 Description: The issue concerns a cross-site scripting XSS vulnerability in the identity provider page. This vulnerability can be exploited by an internal unauthenticated attacker to execute JavaScript in th...
CVE-2023-44040
CVE-2023-44040 affects VeridiumID prior to 3.5.0. An internal unauthenticated attacker can trigger a cross-site scripting (XSS) on the identity provider page, allowing JavaScript execution in the user’s authentication context. Multiple sources (NVD, Red Hat advisory, CVE listings, and third-party...
CVE-2023-44038
In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack...
Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints
This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. A...
CVE-2024-29834
Apache Pulsar CVE-2024-29834 allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics (unload/compact) and to read/create/modify/delete namespace properties across namespaces; impact assumes default authorization provider. Affected: 2...
CVE-2024-29834 Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints
This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. A...
Security Bulletin: Due to use of Apache Pulsar, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to security restrictions bypass
Summary Pulsar is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library. CVE-2023-51437 The below vulnerability have been addressed. Vulnerability Details CVEID:CVE-2023-51437 DESCRIPTION: Apache Pulsar could allow a remote attacker to bypass security restrictions, caused...
GoPlus Report: Blockchain Networks Using API Security Data to Mitigate Web3 Threats
By Uzair Amir Singapore, 28 March 2024 - GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report… This is a post from HackRead.com Read the original post: GoPlus Report: Blockchain Networks Using API Security Data to Mitigate Web3 Threats...
PT-2024-4599 · Nginx · Nginx Proxy Manager
Name of the Vulnerable Software and Affected Versions: NGINX Proxy Manager versions prior to 2.11.3 Description: The issue allows an authenticated user with certificate management privileges to inject OS commands through untrusted input in the DNS provider configuration, potentially enabling remo...
apache-airflow-providers-smtp (>=1.0.0rc1 <=1.8.1rc1) potentially affected by CVE-2024-29735 via apache-airflow (=2.8.2)
apache-airflow PYPI version =2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-airflow-providers-smtp =1.0.0rc1, =1.8.1rc1 Source cves: CVE-2024-29735 Source advisory: OSV:GHSA-CFF3-5QRP-HQX7...
Security Bulletin: Multiple vulnerabilities in IBM's 4769 Developer's Toolkit. CVE-2023-33855, CVE-2023-47150
Summary IBM Common Cryptographic Architecture CCA could allow a remote user to cause a denial of service CVE-2023-47150 or to obtain sensitive information CVE-2023-33855 as described in the vulnerability details section. IBM customers who use the IBM 4769 Developer's Toolkit to create CCA...
Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by...
