5230 matches found
CVE-2024-47832
CVE-2024-47832 affects ssoready (SSOReady) when self-hosted as a Docker-based IDP. The issue is an XML signature bypass caused by differing XML parser behaviors, enabling signature bypass if an attacker can access certain IDP-signed messages. Public hosted instance (https://ssoready.com) is unaff...
SSOReady 数据伪造问题漏洞
SSOReady is an open source development tool for enterprise SSO from SSOReady Open Source. A data forgery vulnerability exists in SSOReady, which stems from the vulnerability of the affected version to XML signature bypass attacks...
CVE-2024-9412: Placement of User into Incorrect Group
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an...
Okta Fixes Critical Vulnerability Allowing Sign-On Policy Bypass
Okta fixed a vulnerability in its Classic product that allowed attackers to bypass sign-on policies. Exploitation required valid…...
CVE-2024-41593
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...
CVE-2024-41593
CVE-2024-41593 affects DrayTek Vigor310 devices up to version 4.3.2.6. The vulnerability is a heap-based buffer overflow in the web interface function ft_payload_dns due to a byte sign-extension in the length argument of a memcpy call, enabling remote code execution. Connected sources confirm the...
CVE-2024-41593: Out-of-bounds Write
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...
go-toolset:ol8 security update
delve golang 1.21.13-3 - Add evp-digest-sign-final.patch - Resolves: RHEL-61109 go-toolset...
RHSA-2024:6880 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 9
Bulletin has no description...
RHSA-2024:6879 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 8
Bulletin has no description...
RHSA-2024:6878 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 7
Bulletin has no description...
RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
Bulletin has no description...
RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8
Bulletin has no description...
RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
Bulletin has no description...
RHSA-2023:2707 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 9
Bulletin has no description...
RHSA-2023:2706 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 8
Bulletin has no description...
RHSA-2023:2705 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.3 security update on RHEL 7
Bulletin has no description...
MAL-2024-9047 Malicious code in world-id-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4873832af5f4bd979a3e2a9acbbcb678f3801e41833eda8c895bdcedf7e1fb36 The OpenSSF Package Analysis project identified 'world-id-sign-in' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...