2172 matches found
Missing Critical Step in Authentication
Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the scope parameter processing of the OAuth2 Dynamic Client Registration endpoint. An attacker can obtain unauthorized access t...
CVE-2025-15039
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
CVE-2025-15039 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
CVE-2025-15039
CVE-2025-15039 concerns the Conditional Authentication (Adaptive Authentication) script in multiple WSO2 products. The flaw is that the script does not properly enforce completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configure...
EUVD-2025-210632
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
MAL-2026-11645 Malicious code in @onereach/si-step-chooser (npm)
npm/@onereach/si-step-chooser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/step-conversation (npm)
npm/@onereach/step-conversation is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11653 Malicious code in @onereach/step-conversation (npm)
npm/@onereach/step-conversation is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11655 Malicious code in @onereach/step-voice (npm)
npm/@onereach/step-voice is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
Malicious code in @onereach/step-voice (npm)
npm/@onereach/step-voice is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
Malicious code in @onereach/step-run-snowflake-query (npm)
npm/@onereach/step-run-snowflake-query is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...
MAL-2026-11654 Malicious code in @onereach/step-run-snowflake-query (npm)
npm/@onereach/step-run-snowflake-query is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...
MAL-2026-11652 Malicious code in @onereach/step-components (npm)
npm/@onereach/step-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...
PT-2026-67434
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...
BIT-SQLITE-2026-51296
SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...
CLEANSTART-2026-DE61610 Security fixes in step-issuer-fips 0.9.9-r2
Package step-issuer-fips version 0.9.9-r2 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...
CLEANSTART-2026-DP50592 Security fixes in step-issuer 0.10.2-r2
Package step-issuer version 0.10.2-r2 fixes 3 vulnerabilities: CVE-2026-42507, CVE-2026-42504, CVE-2026-27145...