854 matches found
Sign in with Apple JWT Token Forgery Vulnerability
Sign in with Apple is an Apple authentication mechanism. Sign in with Apple JWT token forgery vulnerability can be exploited by an attacker to forge a JWT token and gain control of the target user's account access...
"Sign in with Apple" Vulnerability
Researcher Bhavuk Jain discovered a vulnerability in the "Sign in with Apple" feature, and received a $100,000 bug bounty from Apple. Basically, forged tokens could gain access to pretty much any account. It is fixed. EDITED TO ADD 6/2: Another story...
Apple Pays $100K Bounty for Critical 'Sign in With Apple' Flaw
A researcher recently found a critical Apple vulnerability that, if exploited, could enable remote attackers to abuse the “Sign in with Apple” feature to take over victims’ third-party application accounts. The security researcher, Bhavuk Jain, reported the flaw to Apple via its bug bounty progra...
Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account
Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...
Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account
Apple recently paid Indian vulnerability researcher Bhavuk Jain a huge $100,000 bug bounty for reporting a highly critical vulnerability affecting its 'Sign in with Apple ' system. The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
Code injection
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
CVE-2020-10951
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
CVE-2020-10951: Improper Restriction of Rendered UI Layers or Frames
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages...
PT-2020-12443 · Western Digital · Western Digital My Cloud Home +1
Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Home and ibi devices versions prior to 2.2.0 Description: The issue allows clickjacking on sign-in pages. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue...
MS15-059: Description of the security update for Office 2013: June 9, 2015
MS15-059: Description of the security update for Office 2013: June 9, 2015 INTRODUCTION Microsoft has released security bulletin MS15-059. To view the complete security bulletin, go to one of the following Microsoft websites: Home users:http://www.microsoft.com/security/pc-security/updates.aspx...
Alternative ways for security professionals and IT to achieve modern security controls in today’s unique remote work scenarios
With the bulk of end users now working remotely, legacy network architectures that route all remote traffic through a central corporate network are suddenly under enormous strain. The result can be poorer performance, productivity, and user experience. Many organizations are now rethinking their...
March 17, 2020—KB4541331 (OS Build 17763.1131)
None None...
UBUNTU-CVE-2019-12428
An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...
February 25, 2020—KB4537816 (OS Build 16299.1717)
None None...
January 23, 2020—KB4534308 (OS Build 17134.1276)
None None...
Design/Logic Flaw
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH SFTP interface. The vulnerability affects only certain SSH SFTP configurations, and is applicable only if the MySQL database is being used...
CVE-2019-18465: Missing Authentication for Critical Function
In Progress MOVEit Transfer 11.1 before 11.1.3, a vulnerability has been found that could allow an attacker to sign in without full credentials via the SSH SFTP interface. The vulnerability affects only certain SSH SFTP configurations, and is applicable only if the MySQL database is being used...