Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 9

New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 8

New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

RHEL 7 : Red Hat Single Sign-On 7.6.1 security update on RHEL 7 (Important) (RHSA-2022:8961)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8961 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 9 : Red Hat Single Sign-On 7.6.1 security update on RHEL 9 (Important) (RHSA-2022:8963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8963 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.6.1 security update on RHEL 8 (Important) (RHSA-2022:8962)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8962 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

PT-2022-26884 · Unknown · Power Meter Sicam Q100

Name of the Vulnerable Software and Affected Versions: POWER METER SICAM Q100 versions prior to V2.50 Description: A vulnerability has been identified where affected devices do not renew the session cookie after login/logout and also accept user-defined session cookies. An attacker could overwrit...

CVE-2022-28763

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks...

CVE-2022-28763 Improper URL parsing in Zoom Clients

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks...

CVE-2022-28763: Improper Input Validation

The Zoom Client for Meetings for Android, iOS, Linux, macOS, and Windows before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks...

PT-2022-5292 · Ibm · Ibm Cics Tx Standard +1

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard and Advanced version 11.1 Description: The issue is related to insufficiently protected credentials, which could allow a user with physical access to the web browser to gain access to the user's session. This could...

Vulnerability fixed in Zoom

A vulnerability has been fixed in Zoom. The vulnerability allows a malicious person to bypass a security measure and gain access to sensitive data. To exploit the vulnerability, a malicious person needs to victim to open a rogue link. This enables the malicious party to perform further attacks su...

PT-2022-25294 · Siemens · Sicam P855 +1

Name of the Vulnerable Software and Affected Versions: SICAM P850 versions prior to V3.10 SICAM P855 versions prior to V3.10 Description: A vulnerability has been identified in the affected devices, which accept user-defined session cookies and do not renew the session cookie after login/logout...

CVE-2022-40226

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.10, SICAM P8...

CVE-2022-40226

A vulnerability has been identified in SICAM P850 7KG8500-0AA00-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA00-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-0AA0 All versions V3.10, SICAM P850 7KG8500-0AA10-2AA0 All versions V3.10, SICAM P850 7KG8500-0AA30-0AA0 All versions V3.10, SICAM P8...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...

CVE-2022-40622

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the same NAT as the logged in administrator,...