DEBIAN-CVE-2021-35472

An issue was discovered in LemonLDAP::NG before 2.0.12. Session cache corruption can lead to authorization bypass or spoofing. By running a loop that makes many authentication attempts, an attacker might alternately be authenticated as one of two different users...

HCL Notes 安全漏洞

HCL Notes is a highly secure local email client from HCL India. A security vulnerability exists in HCL Notes that can be exploited by an attacker to spoof other users of HCL Notes in order to escalate their privileges...

Cross-Site Request Forgery (CSRF) in monicahq/monica

✍️ Description The /settings/exportToSql endpoint does not have CSRF Protection. This could be used to force download account data and potentially spoof users. 🕵️‍♂️ Proof of Concept Login to user account. Create the following file and open the page in browser. // PoC.html To verify that you are a...

CVE-2020-4421

The CVE-2020-4421 issue affects IBM WebSphere Application Liberty versions 19.0.0.5 through 20.0.0.4. An authenticated user leveraging the openidconnect feature could spoof another user’s identity, enabling an impersonation risk within Liberty environments that expose identity services via OpenID...

Cryptocat has an unspecified vulnerability

Cryptocat is an open source online cryptographic chat application. A security vulnerability exists in Cryptocat versions prior to 2.0.22. An attacker can exploit the vulnerability to spoof arbitrary users and send malicious and misleading messages as other users...

IBM Cloud Private Privilege Escalation Vulnerability

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A privilege escalation vulnerability exists in IBM Cloud Private versions 3.1.1 and 3.1.2, which stems from the program failing to disable a sessio...

TIBCO Data Science Cross-Site Request Forgery Vulnerability

TIBCO Spotfire Data Science is a data analytics platform. A security vulnerability exists in TIBCO Spotfire Data Science that can be exploited by an attacker to submit a special request that can spoof information about other users...

Spoofing

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

Auth0 passport-wsfed-saml2 elevation of privilege vulnerability

Auth0 passport-wsfed-saml2 library is a set of Auth0 development platform of the United States Auth0 company's tool library . A security vulnerability exists in Auth0 passport-wsfed-saml2 library versions prior to 3.0.5. An attacker can exploit the vulnerability to spoof other users and potential...

Microsoft Internet Explorer Content Forgery Vulnerability

Microsoft Internet Explorer is a popular WEB browser. A content forgery vulnerability exists in Microsoft Internet Explorer's handling of WEB pages, which allows remote attackers to exploit the vulnerability by submitting a specially crafted WEB page and tricking the user into parsing it, which c...

CVE-2016-10503

IBM Sametime Meeting Server 8.5.2 and 9.0 are affected. An authenticated and invited user in a Sametime meeting could lower hands in an e-meeting, potentially spoofing vote results. The NVD entry lists CVSSv2/2.0 base score 4.0 (Medium) and CVSSv3/3.0 base score 4.3 (Medium); attack vector NETWOR...

Cloudera HUE Session cookies stored in the database

User session cookies are stored in the database. Combined with the vulnerability related to configuration file which is world readable, it is possible to spoof a user across the entire cluster launching jobs and browsing the datalake, without having to crack password hashes. Cookies are stored in...

CVE-2016-9471

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

CVE-2016-9471

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

Design/Logic Flaw

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

CVE-2016-9471

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

CVE-2016-9471

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

CVE-2016-9471

The vulnerability CVE-2016-9471 affects Revive Adserver prior to 3.2.5 and 4.0.0, caused by insufficient filtering of usernames during user creation. Specifically, control characters were not filtered, allowing apparently identical usernames to co-exist and enabling potential user spoofing. Explo...

CVE-2016-9471: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

PT-2017-10162

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 3.2.5 Revive Adserver versions prior to 4.0.0 Description The issue concerns Special Element Injection due to improper sanitization of usernames when creating users on a Revive Adserver instance. Specifically,...