56 matches found
RHEL 5 : Red Hat Certificate System 8 (RHSA-2017:2560)
The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2560 advisory. Red Hat Certificate System is a complete implementation of an enterprise software system designed to manage enterprise public key infrastructure PKI...
Exploit for CVE-2023-52268
FreeScout End-User Portal Authentication Bypass Exploit CVE-2...
MAL-2024-7944 Malicious code in customer-oauth2-token-management-utility (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7470945b8ee8dd4e437867aa2317e357a5536870671edc131c9c21ee62111acc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Top 4 Essential Strategies for Securing APIs To Block Compromised Tokens
Government bodies are clamping down heavily on institutions and organizations that handle sensitive customer data. For APIs, tokens are used to authenticate users. We live in an era dominated by cloud-native and cloud-first solutions that rely on these services to provide dynamic data storage...
MID-Risk Vulnerabilities in the Axelar Smart Contracts
Lines of code Vulnerability details Impact The vulnerabilities that I have identified could have a significant impact on the Axelar network. These vulnerabilities could be exploited by an attacker to: Gain control of the Axelar network by proposing and voting on malicious proposals. Mint or burn...
If a STRATEGY TOKEN is "Toggled off" STRATEGIES will still be able to withdraw but returning of tokens with replenishReserves will be disabled.
Lines of code Vulnerability details Impact BranchPort.manage allows a registered Strategy to withdraw certain amounts of enabled strategy tokens. It validates access rights ie. if called by a strategy registered for the requested token. It however doesn't check if the token itself is currently...
The vulnerability of the Git-based software platform for collaborative code development on GitLab allows a hacker to circumvent security restrictions.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to shortcomings in the authentication process when managing keys and tokens using deployment scripts. Exploiting this vulnerability allows a malicious actor to circumvent security...
Anybody can initialize claimMint of others people
Lines of code Vulnerability details Impact this can cause poor management of the tokens on the go, without the end customer being aware that any other person will be able to start the claim process without the consent of the owner of the tokens. This is caused by the fact that a KYC check is made...
CVE-2022-39308 GoCD API authentication of user access tokens subject to timing attack during comparison
GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions from 19.2.0 to 19.10.0 inclusive are subject to a timing attack in validation of access tokens due to use of regular string comparison f...
CVE-2022-39308
GoCD versions 19.2.0–19.10.0 are vulnerable to a timing-attack in access token validation due to non–constant-time string comparison, potentially enabling brute-forcing of API tokens. The issue is fixed in GoCD 19.11.0. Workarounds include rate limiting or introducing random delays at the GoCD se...
Add a timelock to PaladinRewardReserve functions
Lines of code Vulnerability details Impact The owner of PaladinRewardReserve can approve and transfer any amount of tokens with no limits on any account. This is not good for investors. To give more trust to users: these functions should be put behind a timelock. Proof of Concept Tools Used VS Co...
The vulnerability of the TrueConf Server software, related to deficiencies in the token management mechanism for user accounts, allows a hacker to gain access to the user account.
The vulnerability of the TrueConf Server software is related to deficiencies in the mechanism for managing user tokens. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the TrueConf Server under a user’s identity...
CVE-2020-15074
OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp...
Passit: Authorization Token is Not expiring After Logout
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: Authorization Token is Not...
Moderate: Red Hat Security Advisory: Red Hat Certificate System 8 security, bug fix, and enhancement update
An update is now available for Red Hat Certificate System 8 with Advanced Access. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...