DEBIAN-CVE-2021-39359

In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...

sssd security update

2.4.0-9.0.1 - Restore default debug level for ssscache Orabug: 32810448 - Restore default debug level for shadow-utils tools Orabug: 32810448 - Revert Redhat's change of disallowing duplicated incomplete gid when 'idprovider=ldap' is used, which caused regression in AD environment. Orabug: 292867...

VPN Test: How to check if your VPN is working or not

The primary function of a Virtual Private Network VPN is to enhance your online privacy and security. It should do this without slowing your Internet too noticeably. Performing a VPN test or two can help you ensure that its up to the mark. VPN privacy test Your Internet Service Provider ISP assig...

Weak password vulnerability in SRG3260 of Huawei Technologies Co.

Huawei Technologies Co., Ltd. is a leading global information and communications technology ICT solutions provider specializing in ICT. A weak password vulnerability exists in Huawei Technologies SRG3260, which can be exploited by attackers to obtain sensitive information...

Xiaomi 10.2.4.g Information Disclosure

Exploit Title: Xiaomi browser 10.2.4.g - Browser Search History Disclosure Date: 27-Dec-2018 Exploit Author: Vishwaraj101 Vendor Homepage: https://www.mi.com/us Software Link: https://www.apkmirror.com/apk/xiaomi-inc/mi-browse/mi-browse-10-2-4-release/ Version: 10.2.4.g Tested on: Tested in Andro...

The vulnerability of the web component of the Essbase Analytic Provider Services allows a perpetrator to trigger a service failure.

The vulnerability of the Essbase Analytic Provider Services web component is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...

Xiaomi browser 10.2.4.g - Browser Search History Disclosure Vulnerability

Exploit Title: Xiaomi browser 10.2.4.g - Browser Search History Disclosure Exploit Author: Vishwaraj101 Vendor Homepage: https://www.mi.com/us Software Link: https://www.apkmirror.com/apk/xiaomi-inc/mi-browse/mi-browse-10-2-4-release/ Version: 10.2.4.g Tested on: Tested in Android Version: 8.1.0...

The vulnerability of the EAP protocol implementation in Juniper Networks SBR Carrier’s service provider server allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the EAP protocol implementation in Juniper Networks SBR Carrier’s service provider server arises due to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to cause service failures or execute arbitrary code by sending specially crafted packets...

Xiaomi browser 10.2.4.g - Browser Search History Disclosure

Exploit Title: Xiaomi browser 10.2.4.g - Browser Search History Disclosure Date: 27-Dec-2018 Exploit Author: Vishwaraj101 Vendor Homepage: https://www.mi.com/us Software Link: https://www.apkmirror.com/apk/xiaomi-inc/mi-browse/mi-browse-10-2-4-release/ Version: 10.2.4.g Tested on: Tested in Andro...

CVE-2021-21644

A cross-site request forgery CSRF vulnerability was found in the config-file-provider Jenkins plugin. The plugin does not require POST requests for an HTTP endpoint which allows attackers to delete configuration files corresponding to an attacker-specified ID...

Session fixation

A session fixation vulnerability exists in Citrix ADC and Citrix Gateway 13.0-82.45 when configured SAML service provider that could allow an attacker to hijack a session...

in erudika/scoold

✍️ Description Bypass rate limit and sent unlimited email to any email address. 💥 Impact Attacker can sent unlimited email to any mail address . Many email service provider has limited email sending like 10000 email per month . If you exeed that limit then you will be extra charged . So, using thi...

How to Configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider

This article describes how to configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider and this article also provides detailed steps to configure Windows Azure to use NetScaler as a Security Token Service STS/ Identity Provider IDP...

DEBIAN-CVE-2021-32786

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers...

CVE-2021-32786

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, oidcvalidateredirecturl does not parse URLs the same way as most browsers...

CVE-2021-22001

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider IdP of type “oauth 1.0” was sent to UAA server...

CVE-2021-22001

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider IdP of type “oauth 1.0” was sent to UAA server...

Cross site request forgery (csrf)

In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider IdP of type “oauth 1.0” was sent to UAA server...

CVE-2021-22001

CVE-2021-22001 affects Cloud Foundry UAA server prior to version 75.3.0. The issue arises when deleting an identity provider (IdP) of type oauth 1.0: the response may reveal sensitive information, including the relaying secret of the provider. The root cause is an information disclosure in the Id...