9951 matches found
CVE-2017-18883
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
PT-2020-8418
Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.4.3 Mattermost Server versions prior to 4.3.3 Description: An issue was discovered where attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...
CVE-2017-18905: Insufficient Session Expiration
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled...
CVE-2017-18883: Insufficient Entropy
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
CVE-2020-0188
In onCreatePermissionRequest of SettingsSliceProvider.java, there is a possible permissions bypass due to a PendingIntent error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
GHSA-58PP-9C76-5625 jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider aka apache/commons-proxy...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
CVE-2020-0114
In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is not needed...
keycloak: session hijack using the user access token
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
Hosting Provider's Database of Crooked Customers Leaked
A hacker has leaked online the database of the largest free hosting service popular with cybercriminals, the result of a breach that took down the service earlier this year, according to a published report. A hacker going by the online name of “KingNull” uploaded on a file-hosting site a database...
jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider
A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption...
PT-2020-13372
Name of the Vulnerable Software and Affected Versions Teradici PCoIP Standard Agent for Windows versions 19.11.1 and earlier Teradici PCoIP Graphics Agent for Windows versions 19.11.1 and earlier Description The initialization of the pcoip credential provider creates an insecure named pipe,...
How to Remove Missing Restore Points From Veeam Cloud Connect Backups
Purpose This article documents how to handle a situation in which the tenant of a Cloud Provider needs to forget missing restore points from a backup chain stored in a Cloud Repository. By design, the Forget and Remove operations are not available for restore points in a Cloud Repository. A resto...
The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, allows a malicious individual to gain unauthorized access to protected information.
The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, is related to deficiencies in access control. Exploiting this vulnerability could allow an...
The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, allows a malicious individual to gain unauthorized access to protected information.
The vulnerability of the Work Provider Administration component of the application, which is responsible for accessing, organizing, and interacting with various types of Oracle Universal Work Queue tasks, is related to deficiencies in access control. Exploiting this vulnerability could allow an...
