Reddit: One-click account hijack for anyone using Apple sign-in with Reddit, due to response-type switch + leaking href to XSS on www.redditmedia.com

Hi, Description I've been researching new ways to steal OAuth codes and access-tokens using postMessage, and I found a way for me to steal the code and/or access-token from Apple-sign-in on reddit.com allowing a full account hijack of the account in Reddit. The way it works is this: 1. Attacker...

Updated cifs-utils packages fix security vulnerability

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges. CVE-2022-27239 cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign...

Android and Chrome Users Can Soon Generate Virtual Credit Cards to Protect Real Ones

Google on Wednesday took to its annual developer conference to announce a host of privacy and security updates, including support for virtual credit cards on Android and Chrome. "When you use autofill to enter your payment details at checkout, virtual cards will add an additional layer of securit...

PT-2022-19313

Name of the Vulnerable Software and Affected Versions Tieba-Cloud-Sign version 4.9 Description A cross-site scripting XSS issue was found in the strip tags function, which can be exploited. Recommendations For version 4.9, consider disabling the strip tags function until a patch is available to...

CVE-2022-28920: Improper Neutralization of Input During Web Page Generation

Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting XSS vulnerability via the function striptags...

Tieba-Cloud-Sign 跨站脚本漏洞

Tieba-Cloud-Sign Baidu Post Bar Cloud Sign is a Chinese MoeNet open source configuration on the server without any operation can be realized without any operation of the full-automatic post bar signing. Tieba-Cloud-Sign v4.9 security vulnerabilities , attackers can use the vulnerability to inject...

OESA-2022-1626 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. The in-kernel CIFS filesystem relies on a set of user-space tools. That package of tools is called cifs-utils.Although not really part of Samba proper, these tools were originally part of the...

CVE-2022-22481

IBM Navigator for i 7.2, 7.3, and 7.4 heritage version could allow a remote attacker to obtain access to the web interface without valid credentials. By modifying the sign on request, an attacker can gain visibility to the fully qualified domain name of the target system and the navigator tasks...

PT-2022-15461 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.2 through 7.4 Description: The issue allows a remote attacker to obtain access to the web interface without valid credentials by modifying the sign on request. This grants the attacker visibility to the fully...

Design/Logic Flaw

ecdsautils is a tiny collection of programs used for ECDSA keygen, sign, verify. ecdsaverifypreparelegacy does not check whether the signature values r and s are non-zero. A signature consisting only of zeroes is always considered valid, making it trivial to forge signatures. Requiring multiple...

RHEL 7 : Red Hat Single Sign-On 7.5.2 security update on RHEL 7 (Moderate) (RHSA-2022:1711)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1711 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7

New Red Hat Single Sign-On 7.5.2 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8

New Red Hat Single Sign-On 7.5.2 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update

A security update is now available for Red Hat Single Sign-On 7.5 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 8 : Red Hat Single Sign-On 7.5.2 security update on RHEL 8 (Moderate) (RHSA-2022:1712)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1712 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

GHSA-PF38-CW3P-22Q9 Keycloak is vulnerable to IDN homograph attack

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges...

UBUNTU-CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

CVE-2022-29869

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = equal sign characters but is not a valid credentials file...

cifs-utils 日志信息泄露漏洞

cifs-utils is a toolkit from the individual developer Pavel Shilovsky. It provides utilities for managing CIFS network file system installations. A security vulnerability exists in cifs-utils version 6.14 and earlier, which stems from an information leak when a file contains the = equals sign...

Improper authorization in Keycloak

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted...