undertow: Double AJP response for 400 from EAP 7 results in CPING failures

A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. Linux kernel suffers from a resource management error vulnerability. An attacker could exploit this vulnerability by forcing the reuse of a freed memory region via nfs42sscopen...

Linux kernel 资源管理错误漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in the Linux kernel. An attacker exploits this vulnerability to force the reuse of a freed memory region via putdev to trigger ...

Mozilla: Fullscreen notification bypass via windowName

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...

Mozilla: Fullscreen notification bypass via windowName

The Mozilla Foundation Security Advisory describes this flaw as: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome Mac and Linux versions prior to 108.0.5359.124, and Windows versions prior to 108.0.5359.125, which stems from a post-release reuse vulnerability in Profiles...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome Mac and Linux versions prior to 108.0.5359.124, and Windows versions prior to 108.0.5359.125, which stems from a post-release reuse vulnerability in Blink Media...

PT-2022-24784 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the offline access scope in Keycloak, affecting users of shared computers more, especially if cookies are not cleared. This issue is due to a lack of root session...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in Google Chrome Mac and Linux versions prior to 108.0.5359.124, and Windows versions prior to 108.0.5359.125, which stems from a post-release reuse vulnerability in Mojo IPC...

Mozilla Thunderbird 资源管理错误漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. Mozilla Thunderbird suffers from a resource management error vulnerability that stems fro...

Google Chrome 资源管理错误漏洞

Google Chrome is a web browser from Google, Inc. and V8 is an open source JavaScript engine. A security vulnerability exists in Google Chrome versions prior to 108.0.5359.124 for Mac and Linux, and prior to 108.0.5359.125 for Windows, which stems from a post-release reuse in Aura...

HPESBNW04396 rev.2 - Aruba EdgeConnect Enterprise Orchestrator, Multiple Vulnerabilities

Potential Security Impact: Remote: Arbitrary Code Execution, Authentication Bypass, Cross-Site Scripting XSS, Escalation of Privilege, SQL Injection, Session Reuse SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba EdgeConnect Enterprise Orchestration Software see details in...

GHSA-JV85-MQXJ-3F9J Sentry vulnerable to invite code reuse via cookie manipulation

With a known valid invite link i.e. not already accepted or expired an unauthenticated attacker can manipulate the cookie to allow the same invite link to be reused on multiple accounts when joining an organization. Impact An attacker with a valid invite link can create multiple users and join th...

Sentry vulnerable to invite code reuse via cookie manipulation

With a known valid invite link i.e. not already accepted or expired an unauthenticated attacker can manipulate the cookie to allow the same invite link to be reused on multiple accounts when joining an organization. Impact An attacker with a valid invite link can create multiple users and join th...

USN-5774-1 linux-azure vulnerabilities

Jann Horn discovered that the Linux kernel did not properly track memory allocations for anonymous VMA mappings in some situations, leading to potential data structure reuse. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2022-427...

ARM Mali GPU Kernel Driver 资源管理错误漏洞

The ARM Mali GPU Kernel Driver is a driver for a graphics processor unit from ARM UK. The Arm Mali GPU Kernel Driver suffers from a resource management error vulnerability that originates from the fact that an unprivileged user can access freed memory leading to post-freedom reuse through imprope...

PYSEC-2022-43011

Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invite link could manipulate a cookie to allow the same invite link to be reused on multiple accounts when joining an organization. As a result...