CVE-2019-1010161

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

CVE-2019-1010161

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

Authentication flaw

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

CVE-2019-1010161

CVE-2019-1010161 affects perl-CRYPT-JWT 0.022 and earlier, with Incorrect Access Control enabling bypass of authentication through crafted input. The vulnerable code is JWT.pm, line 614 in _decode_jws(). The attack vector involves network input. A fix is available in version 0.023.

CVE-2019-1010161

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

CVE-2019-1010161

perl-CRYPT-JWT 0.022 and earlier is affected by: Incorrect Access Control. The impact is: bypass authentication. The component is: JWT.pm for JWT security token, line 614 in decodejws. The attack vector is: network connectivitycrafting user-controlled input to bypass authentication. The fixed...

Cross-site Request Forgery (CSRF)

Mediawiki is vulnerable to cross-site request forgery CSRF. It is possible because it logs out without using a security token, allowing the use of action=logout API in such a way that a remote attacker can log a user out on their behalf...

PT-2019-8609

Name of the Vulnerable Software and Affected Versions Amcrest IPM-721S version V2.420.AC00.16.R.20160909 Description The issue concerns a brute force attack vulnerability. When 30 incorrect password attempts are detected using the Web and HTTP API interface, a 5-minute timeout policy is enforced...

Security Bulletin: IBM Robotic Process Automation Client Security Token is written to the Client log file (CVE-2019-4299)

Summary IBM Robotic Process Automation Client Security Token is written to the Client log file Vulnerability Details CVEID: CVE-2019-4299 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere could allow a local user to obtain highly sensitive information from log files when...

Microsoft Windows - Win32k Local Privilege Escalation Exploit

Exploit for windows platform in category local exploits CVE-2019-0803 Win32k Elevation of Privilege Poc Reference ----------------------------- steal Security token https://github.com/mwrlabs/CVE-2016-7255 EDB Note: Download...

Exploit for CVE-2019-0803

CVE-2019-0803 Win32k Elevation of Privilege P...

Microsoft Windows - Win32k Local Privilege Escalation

Microsoft Windows - Win32k Local Privilege Escalation CVE-2019-0803 Win32k Elevation of Privilege Poc Reference ----------------------------- steal Security token https://github.com/mwrlabs/CVE-2016-7255 EDB Note: Download...

Nextcloud: W3 Total Cache plugin multiple vulnerabilities

W3 Total Cache plugin version = 0.9.4.1 on the https://nextcloud.com has multiple vulnerabilities. See the screenshot.png Impact Remote Command Execution, Unauthenticated Security Token Bypass, Unauthenticated Arbitrary File Read etc...

CVE-2018-20340

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is...

CVE-2018-20340

CVE-2018-20340 affects Yubico libu2f-host 1.1.6, with unchecked buffers in devs.c that could allow a crafted USB token to overflow a buffer and execute code on a host where the library is in use (not with a genuine YubiKey). Public advisories also reference CVE-2019-9578, related to uninitialized...

CVE-2018-20340

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is...

CVE-2018-20340

Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to attempt to execute malicious code using a crafted USB device masquerading as a security token on a computer where the affected library is...

WP GDPR Compliance <= 1.4.2 - Unauthenticated Call Any Action or Update Any Option

The plugin WP GDPR Compliance allows unauthenticated users to execute any action and to update any database value. If the request data form is available for unauthenticated users, even unauthenticated users are able to do this. See references for discussion of the issue. The problem is in the fil...

Design/Logic Flaw

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

Microsoft Windows: Audit Authorization Policy Change

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winauthorizationpolicychange.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Authorization Policy Change Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...