Tenable Nessus Agent 7.2.0 - 8.2.2 Multiple Vulnerabilities (TNS-2021-04)

Tenable Nessus Agent is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessusagent";...

Vulnerabilities fixed in MediaWiki

Vulnerabilities have been fixed in MediaWiki. One vulnerability makes it impossible for a blocked user to reset the security token reset. This is problematic when the security token falls into wrong hands. The other two vulnerabilities involve a so-called Cross-Site Scripting XSS. MediaWiki has...

CVE-2021-20077

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...

Code injection

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...

CVE-2021-20077

CVE-2021-20077 affects Tenable Nessus Agent versions 7.2.0–8.2.2 installed on Amazon EC2. During initial linking, the agent could inadvertently capture the IAM role security token on the local host, enabling a privileged attacker to obtain the token. The commonly cited remediation is upgrading to...

CVE-2021-20077

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...

Tenable Nessus Agent < 8.2.3 Multiple Vulnerabilities (TNS-2021-04)

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token. Additionally, one third-part...

CVE-2021-20077: Undefined Security Weakness

Nessus Agent versions 7.2.0 through 8.2.2 were found to inadvertently capture the IAM role security token on the local host during initial linking of the Nessus Agent when installed on an Amazon EC2 instance. This could allow a privileged attacker to obtain the token...

Timing side channel vulnerability in endpoint request handler in Vaadin 15-19

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 Vaadin 15.0.0 through 18.0.6, and com.vaadin:fusion-endpoint version 6.0.0 Vaadin 19.0.0 allows attacker to guess a security token for Fusion endpoints via timing attack...

The vulnerability in the implementation of window.webkit in Firefox’s web browser for the iOS operating system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability in the Firefox web browser’s window.webkit implementation for the iOS operating system relates to the disclosure of the SECURITYTOKEN token. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected information...

Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 Vaadin 7.0.0 through 7.7.23, and 8.0.0 through 8.12.2 Vaadin 8.0.0 through 8.12.2 allows attacker to guess a security token via timing attack. See CWE-208: Observable Timi...

CVE-2019-8638

creationtimestamp| type| source ---|---|--- 2020-10-27 23:40:58+00:00| seen| https://t.me/cibsecurity/15636...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2020-41083)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 26 for iOS-based platforms. An attacker could exploit the vulnerability to obtain a security token used for bridging...

PT-2020-5579

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 25 Description The issue is related to the implementation of window.webkit in the Firefox web browser for iOS, which involves the disclosure of information about the SECURITY TOKEN. This could allow a remote...

Storefront 3.12 - SAML authentication is not working.when using IDP like Forge Rock

Storefront 3.12 - SAML authentication is not working with IDP like Forge Rock. Error Message on Store Front Page Error Message: "There was a Failure with mapped account." Following Error message is thrown in the Event Viewer The security token failed validation...

CVE-2020-3952 - VMware vCenter Server vmdir Information Disclosure

Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller PSC, does not correctly implement access controls. Recent assessments: wvu-r7 at April 16, 2020 1:25pm UTC reported: Technical details on the vuln are out:...

CVE-2013-4227

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

CVE-2013-4227

Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...

Unable to Add Workers to Bahrain or Hong Kong Regions

Challenge When adding a worker instance to the Bahrain or Hong Kong regions, the following error occurs: AWS was not able to validate the provided access credentials. Cause Veeam Plug-In for AWS uses the Global STS endpoint. Solution To add a worker to the Bahrain or Hong Kong regions, do the...