CVE-2021-37997

Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page...

MVP Health Care secures member portal access with Microsoft Azure Active Directory B2C

Hello! I’m Sue Bohn, Microsoft Vice President of Program Management for Identity and Network Access. In today’s Voice of the Customer blog post, Chief Technology Officer and Chief Information Security Officer David Swits of MVP Health Care shares how Microsoft Azure Active Directory B2C helped th...

MVP Health Care secures member portal access with Microsoft Azure Active Directory B2C

Hello! I’m Sue Bohn, Microsoft Vice President of Program Management for Identity and Network Access. In today’s Voice of the Customer blog post, Chief Technology Officer and Chief Information Security Officer David Swits of MVP Health Care shares how Microsoft Azure Active Directory B2C helped th...

CVE-2021-37997: Use After Free

Use after free in Sign-In in Google Chrome prior to 95.0.4638.69 allowed a remote attacker who convinced a user to sign into Chrome to potentially exploit heap corruption via a crafted HTML page...

Google Chrome Microsoft Edge Code Execution

The vulnerability of the Sign-In component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure through a specially created web page...

UVI-2021-1002120 net/tls: Fix flipped sign in tls_err_abort() calls

net/tls: Fix flipped sign in tlserrabort calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.16 by commit...

UVI-2021-1002057 net/tls: Fix flipped sign in tls_err_abort() calls

net/tls: Fix flipped sign in tlserrabort calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.77 by commit...

UVI-2021-1002016 net/tls: Fix flipped sign in tls_err_abort() calls

net/tls: Fix flipped sign in tlserrabort calls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.157 by commit...

PT-2021-30585

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.16 Description The issue is related to a fix in the tls err abort function calls, where a flipped sign was corrected. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2021-30654

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.17 through 5.14 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-30481

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.17 through 5.4.156 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

PT-2021-26659

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 4.17 through 5.14 Description: A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel version...

PT-2021-26590

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.16 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-30522

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.17 through 5.10.76 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

PT-2021-26486

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.17 through 5.4.156 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

PT-2021-26527

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 4.17 through 5.10.76 Description A potential security issue exists due to a flipped sign in tls err abort calls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel version...

MTN Group: Default Admin Username and Password on remedysso.mtncameroon.net

Summary: A Remedy Single Sign-On Remedy SSO Server is running at https://remedysso.mtncameroon.net/rsso/admin//. It is possible to access the application is using the default Administrator credentials. Steps To Reproduce: Go to https://remedysso.mtncameroon.net/rsso/admin// and login with...

Remote Code Execution (RCE)

chrome is vulnerable to remote code execution. The vulnerability exists due to a security issue found in the Sign-In component of the Chromium browser...

CVE-2021-42837

An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login page. Any valid user from the SAML/OAuth provider can be used as the username with an arbitrary password, and login will succeed...

Kubernetes: elections.k8s.io uses weak session secret key, may place elections at risk

The elections.k8s.io application used a weak Flask SECRETKEY, the string "N/A", to sign authentication cookies. This allowed the complete compromise of the application, as the session could be manipulated...