1725 matches found
CVE-2022-33968
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read...
CVE-2022-33968
In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, when an LTM monitor or APM SSO is configured on a virtual server, and NTLM challenge-response is in use, undisclosed traffic can cause a buffer over-read...
CVE-2022-27620
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors...
Path traversal
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors...
CVE-2022-27620
CVE-2022-27620 impacts the webapi component of Synology SSO Server prior to 2.2.3-0331. The vulnerability is a path traversal flaw that allows remote authenticated users to read arbitrary files via unspecified vectors. Affected product/version: Synology SSO Server (webapi) before 2.2.3-0331. Impa...
CVE-2022-27620
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors...
PT-2022-18526 · Synology · Synology Sso Server
Name of the Vulnerable Software and Affected Versions: Synology SSO Server versions prior to 2.2.3-0331 Description: The issue is related to a Path Traversal vulnerability in the webapi component, allowing remote authenticated users to read arbitrary files via unspecified vectors. Recommendations...
Synology SSO Server 路径遍历漏洞
Synology SSO Server is a server software from China-based Synology Inc. that provides single sign-on functionality. A path traversal vulnerability exists in Synology SSO Server versions prior to 2.2.3-0331, which stems from an improper restriction on the pathname of a restricted directory in the...
CVE-2022-27620
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors...
WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability
Authentication Bypass vulnerability discovered by Lana Codes in WordPress OAuth 2.0 client for SSO plugin versions = 1.11.3. Solution Update the WordPress OAuth 2.0 client for SSO plugin to the latest available version at least 1.11.4...
CVE-2016-4427
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...
CVE-2016-4427
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...
Design/Logic Flaw
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...
CVE-2016-4427
In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...
CVE-2016-4427
CVE-2016-4427 affects Zulip before 1.3.12, where deactivated users could access messages if Single Sign-On (SSO) is enabled. The issue is documented across multiple sources (Red Hat, OSV, NVD/CVE record) and is limited to versions prior to 1.3.12; the security impact is that non-active accounts m...
Inductive Automation Ignition 访问控制错误漏洞
Inductive Automation Ignition is a suite of integrated software platforms for SCADA systems from Inductive Automation, Inc. The platform supports SCADA Data Acquisition and Monitoring Systems, HMI Human Machine Interface, and more. Inductive Automation Ignition suffers from an Access Control Erro...
CVE-2022-2133
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address...
CVE-2022-31102
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This...
Argo CD SSO users vulnerable to Cross-site Scripting
Impact All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This vulnerability only affects Argo CD instances which have SSO enabled. The exploit...
GHSA-PMJG-52H9-72QV Argo CD SSO users vulnerable to Cross-site Scripting
Impact All versions of Argo CD starting with 2.3.0 are vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This vulnerability only affects Argo CD instances which have SSO enabled. The exploit...