NextAuth.js Security Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A security vulnerability exists in NextAuth.js that stems from a token validation vulnerability...

SAP HANA Database 加密问题漏洞

SAP HANA is a set of high-performance real-time data analytics platform from Germany's SAP, which supports users to query and analyze real-time business data. An improper signature validation vulnerability exists in SAP HANA Database versions 1.0 and 2.0. The vulnerability stems from the program...

Eclipse Vertx-web 跨站请求伪造漏洞

Eclipse Vertx-web is an Eclipse Foundation framework for building Web applications . A cross-site request forgery vulnerability exists in the Vert.x-Web framework v4.0 milestone 1-4, where the source program fails to perform proper CSRF validation. Instead of comparing the CSRF token in the reque...

Code injection

Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if token === apiToken return true; return false;" code block...

Nayutaco Ptarmigan Trust Management Issues Vulnerabilities

Nayutaco Ptarmigan is a C/C++ based software for bitcoind network support from the Perth Nayutaco team. A security vulnerability exists in versions of Ptarmigan prior to 0.2.3, which stems from a lack of API token validation, e.g., the "if token === apiToken return true; return false;" code block...

CVE-2020-7787

This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is cause...

Salvoravida React-adal Authorization Issues Vulnerability

Salvoravida React-adal is a JS language based codebase for interacting with Azure Active Directory by Salvoravida Individual Developer. react-adal suffers from an authorization issue vulnerability that stems from the fact that for specially designed JWT tokens and request URLs, it is possible to...

Python Data Forgery Problem Vulnerability

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python oic versions prior to 1.2.1, which stems from the fact that there are...

Signature Validation Bypass

servicestack is vulnerable to signature validation bypass. The token validation function does not check a valid minimum length and null for a JWT signature, allowing an attacker to bypass the signature verification...

Token Validation Bypass

parse-server is vulnerable to token validation bypass. Lack of checking deleted sessions after the websocket connection was established allows clients with invalid session tokens to still receive subscription object...

Token Validation Bypass

spreeapi is vulnerable to token validation bypass. Failure to check for the expiry of the doorkeepertoken allows an attacker to access Storefront API v2 endpoints using expired user tokens...

CVE-2020-16969

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user. To exploit the vulnerability, an attacker could include...

CVE-2020-16969

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user. To exploit the vulnerability, an attacker could include...

Information disclosure

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user. To exploit the vulnerability, an attacker could include...

CVE-2020-16969

CVE-2020-16969 affects Microsoft Exchange Server. It is an information-disclosure vulnerability rooted in how tokens are validated when handling certain messages. An attacker could craft OWA messages that are loaded from an attacker-controlled URL, enabling information disclosure without warning....

Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2020-57590)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. An information disclosure vulnerability exists in Microsoft Exchange Server. The vulnerability stems from a problem with the way the product validates tokens when processing certain emails. An attacker could...

Microsoft Exchange Information Disclosure Vulnerability

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user. To exploit the vulnerability, an attacker could include...

PT-2020-4383 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to an information disclosure vulnerability in how Microsoft Exchange validates tokens when handling certain messages. This could allow a remote attack...

Microsoft SharePoint Server 2016 < 16.0.5032.1002 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source...

Microsoft SharePoint Server 2010 < 14.0.7255.5000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in PerformancePoint Services for SharePoint Server when the software fails to check the source...