4554 matches found
samba: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result cou...
GHSA-JQFP-M5F8-VG28 Dolibarr Cross Site Scripting (XSS) vulnerability
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
CVE-2021-42220
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
CVE-2021-42220
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
Cross site scripting
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
CVE-2021-42220
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
UBUNTU-CVE-2021-42220
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
CVE-2021-42220
A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...
Can drain any promotion rewards with a evil ticket
Handle gzeon Vulnerability details Impact TwabRewards check legitimacy of ticket by checking if the ticket have a controller method. function requireTicketaddress ticket internal view requireticket != address0, "TwabRewards/ticket-not-zero-address"; bool succeeded, bytes memory data =...
If a promoter cancels a promotion, unclaimed rewards of ticket holders are lost
Handle hubble Vulnerability details Impact Loss of rewards for the ticket holders who have not yet claimed the rewards accrued until the previous epocs, if the promoter cancels the promotion after any epoch. Proof of Concept contract : TwabRewards function : cancelPromotion line 132 delete...
A malicious ticket can drain the tokens
Handle pauliax Vulnerability details Impact Anyone can createPromotion with any arbitrary ticket supposed it follows the proposed interface. Thus, it is possible to create a promotion with a malicious ticket that returns arbitrary values for getAverageBalanceBetween and...
Scalpers, and their bot armies, swing in to net web-based Spiderman tickets
29 November 2021 was “Spider Monday” and tickets for Marvel’s film Spider-Man: No Way Home went on sale with the sort of marketing fervor for which Disney and the Marvel Cinematic Universe MCU are famous. As tickets to one of the most eagerly anticipated Christmas films featuring one of the most...
krb5: NULL pointer dereference in process_tgs_req() in kdc/do_tgs_req.c via a FAST inner body that lacks server field
A flaw was found in krb5. The Key Distribution Center KDC in MIT Kerberos 5 has a NULL pointer dereference via a FAST inner body that lacks a server field. An authenticated attacker could use this flaw to crash the Kerberos KDC server. The highest threat from this vulnerability is to system...
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
Description Stored XSS via Markdown at Description or Comment of Ticket Detail When rendering to Markdown, the application does not filter and check the properties are valid, so when the user enters XSS it will render as XSS . Proof of Concept // PoC.req POST /tickets/submit/ HTTP/1.1 Host:...
Privilege Escalation
samba is vulnerable to escalation of privilege. The vulnerability exists due to the lack of sanitization of user's authorization when RODC read-only domain controller is used when printing administration ticket...
UBUNTU-CVE-2020-25719
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result cou...
A user in an AD Domain could become root on
Description Windows Active Directory AD domains have by default a feature to allow users to create computer accounts, controlled by ms-DS-MachineAccountQuota. In addition some presumably trusted users have the right to create new users or computers in both Samba and Windows Active Directory...
OESA-2021-1417 samba security update
Security Fixes: A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ Ticket Granting Server - Request. An authenticated user could use this flaw to crash the samba server.CVE-2021-3671...
Debian: Security Advisory (DSA-5000-2)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
