7644 matches found
CVE-2023-45134 XWiki Platform XSS vulnerability from account in the create page form via template provider
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. org.xwiki.platform:xwiki-platform-web starting in version 3.1-milestone-1 and prior to 13.4-rc-1, org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.2 and 15.5-rc-1, and...
AZL-78558 CVE-2023-5363 affecting package openssl-fips-provider 3.1.2-1
Issue summary: A bug has been identified in the processing of key and initialisation vector IV lengths. This can lead to potential truncation or overruns during the initialisation of some symmetric ciphers. Impact summary: A truncation in the IV can result in non-uniqueness, which could result in...
CVE-2023-41960
The CVE-2023-41960 entry describes an issue where an unprivileged third-party application can interact with a content-provider unsafely exposed by the Android Agent application, potentially allowing modification of sensitive settings in the Android Client. Affected component: Android Agent’s cont...
CVE-2023-41960
The vulnerability allows an unprivilegeduntrusted third-party application to interact with a content-provider unsafely exposed by the Android Agent application, potentially modifying sensitive settings of the Android Client application itself...
PT-2023-28192 · Unknown · Android Agent
Name of the Vulnerable Software and Affected Versions: Android Agent application affected versions not specified Description: The issue allows an unprivileged untrusted third-party application to interact with a content-provider unsafely exposed by the Android Agent application. This could...
PT-2023-8351 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.7.1 macOS versions prior to 13.6.1 macOS versions prior to 14.1 Description: The issue exists due to insufficient input validation in a component of the macOS operating system, specifically the File Provider. This c...
PT-2023-29430 · Xwiki · Xwiki Platform +2
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 3.1-milestone-1 through 13.4-rc-1 org.xwiki.platform:xwiki-platform-web-templates versions prior to 14.10.2 and 15.5-rc-1 org.xwiki.platform:xwiki-web-standard versions 2.4-milestone-2 through 3.1-milestone-1...
1Password Detects Suspicious Activity Following Okta Support Breach
Popular password management solution 1Password said it detected suspicious activity on its Okta instance on September 29 following the support system breach, but reiterated that no user data was accessed. "We immediately terminated the activity, investigated, and found no compromise of user data ...
GHSA-267V-3V32-G6Q5 Cross-site Scripting via missing Binding syntax validation
Impact The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP contex...
IBM Security Verify Access Resource Management Error Vulnerability
IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...
Debian DSA-5528-1 : node-babel7 - security update
The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5528 advisory. - Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile...
CVE-2023-45683
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
Cross site scripting
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
UBUNTU-CVE-2023-45683
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
CVE-2023-45683 Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics
Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...
OAuth Identity XWiki App Cross-Site Scripting Vulnerability
OAuth Identity XWiki App is an open source XWiki SAS library of essential elements for building identities and service providers based on OAuth authorization. A cross-site scripting vulnerability exists in OAuth Identity XWiki App, which stems from the identityOAuth parameter sent in a GET reques...
CVE-2022-43740
IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921...