840 matches found
CVE-2020-26254
omniauth-apple is the OmniAuth strategy for "Sign In with Apple" RubyGem omniauth-apple. In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the...
CVE-2020-26254
omniauth-apple is the OmniAuth strategy for "Sign In with Apple" RubyGem omniauth-apple. In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the...
CVE-2020-26254 omniauth-apple allows attacker to fake their email address during authentication
omniauth-apple is the OmniAuth strategy for "Sign In with Apple" RubyGem omniauth-apple. In omniauth-apple before version 1.0.1 attackers can fake their email address during authentication. This vulnerability impacts applications using the omniauth-apple strategy of OmniAuth and using the...
CVE-2020-26254
The CVE concerns the RubyGem omniauth-apple, used as an OmniAuth strategy for Sign In with Apple. In affected versions prior to 1.0.1, an attacker can set the value of info.email in OmniAuth's Auth Hash Schema to an arbitrary email (including others’ addresses). This can enable spoofed identities...
Security update for grafana (moderate)
openSUSE Security Update: Security update for grafana Announcement ID: openSUSE-SU-2020:1611-1 Rating: moderate References: 1044444 1044933 1115960 1170557 Cross-References: CVE-2018-19039 CVE-2019-15043 CVE-2020-12245 CVE-2020-13379 Affected Products: openSUSE Backports SLE-15-SP1 An update that...
FreeBSD : Gitlab -- multiple vulnerabilities (1fb13175-ed52-11ea-8b93-001b217b3468)
Gitlab reports : Vendor Cross-Account Assume-Role Attack Stored XSS on the Vulnerability Page Outdated Job Token Can Be Reused to Access Unauthorized Resources File Disclosure Via Workhorse File Upload Bypass Unauthorized Maintainer Can Edit Group Badge Denial of Service Within Wiki Functionality...
dental-office-sign-in-form.com Cross Site Scripting vulnerability OBB-1275496
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Authentication Weakness in keystone
There is an authentication weakness vulnerability in keystone before version 0.3.16. Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in...
New Privacy Features Added to the Upcoming Apple iOS 14 and macOS Big Sur
Unprecedented times call for unprecedented measures. No, we're not talking about 'coronavirus,' the current global pandemic because of which Apple—for the very first time in history—organized its Worldwide Developer Conference WWDC virtually. Here we're talking about a world in which we are all...
Rockstar Games: SocialClub Account Take Over Through Import Friends feature
In this report, the researcher identified a vulnerability in a Social Club feature intended to allow users to import their friends list from Facebook and other social media sites. However, if a targeted victim were to visit a crafted site containing a specific malicious script that exploited this...
Sign in with Apple JWT Token Forgery Vulnerability
Sign in with Apple is an Apple authentication mechanism. Sign in with Apple JWT token forgery vulnerability can be exploited by an attacker to forge a JWT token and gain control of the target user's account access...
"Sign in with Apple" Vulnerability
Researcher Bhavuk Jain discovered a vulnerability in the "Sign in with Apple" feature, and received a $100,000 bug bounty from Apple. Basically, forged tokens could gain access to pretty much any account. It is fixed. EDITED TO ADD 6/2: Another story...
Apple Pays $100K Bounty for Critical 'Sign in With Apple' Flaw
A researcher recently found a critical Apple vulnerability that, if exploited, could enable remote attackers to abuse the “Sign in with Apple” feature to take over victims’ third-party application accounts. The security researcher, Bhavuk Jain, reported the flaw to Apple via its bug bounty progra...
Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account
Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...
Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account
Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple ' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
Code injection
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
PT-2020-12443 · Western Digital · Western Digital My Cloud Home +1
Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Home and ibi devices versions prior to 2.2.0 Description: The issue allows clickjacking on sign-in pages. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue...