keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks...

PAN-OS: Spoofed Kerberos key distribution center authentication bypass

An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center KDC before authenticating users. This affects all forms of authentication that use ...

PT-2020-15225

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 7.1.26 Palo Alto Networks PAN-OS versions prior to 8.0.21 Palo Alto Networks PAN-OS versions prior to 8.1.13 Palo Alto Networks PAN-OS versions prior to 9.0.6 Description An authentication bypass by...

CVE-2020-2002: Authentication Bypass by Spoofing

An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center KDC before authenticating users. This affects all forms of authentication that use ...

UBUNTU-CVE-2019-20795

iproute2 before 5.1.0 has a use-after-free in getnetnsidfromname in ip/ipnetns.c. NOTE: security relevance may be limited to certain uses of setuid that, although not a default, are sometimes a configuration option offered to end users. Even when setuid is used, other factors such as C library...

Longbrothers Digital OKLOK Information Disclosure Vulnerability (CNVD-2021-25679)

Longbrothers Digital Fingerprint Bluetooth Padlock FB50 and OKLOK are both products of Longbrothers Digital China.Fingerprint Bluetooth Padlock FB50 is a fingerprint round The Fingerprint Bluetooth Padlock FB50 is a fingerprint round padlock that supports fingerprint unlocking, remote unlocking...

Default credentials

The OKLOK 3.1.1 mobile companion app for Fingerprint Bluetooth Padlock FB50 2.3 allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary...

systemd: services with DynamicUser can create SUID/SGID binaries

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially...

systemd: services with DynamicUser can get new privileges and create SGID binaries

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow a cooperating process to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to...

CVE-2019-15793

In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group ids before performing operations in the lower filesystem were translating them into inituserns, whereas they should have been translated in...

CVE-2020-0576

creationtimestamp| type| source ---|---|--- 2020-04-15 20:44:31+00:00| seen| https://t.me/cibsecurity/11281...

DEBIAN-CVE-2019-12522

An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leavesuid call. leavesuid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child proces...

UBUNTU-CVE-2019-12522

An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leavesuid call. leavesuid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child proces...

Privilege Escalation

kernel is vulnerable to privilege escalation. The vulnerability exists as the exitnotify function in the Linux kernel did not properly reset the exit signal if a process executed a set user ID setuid application before exiting. This could allow a local, unprivileged user to elevate their privileg...

CVE-2019-19606

creationtimestamp| type| source ---|---|--- 2020-03-31 03:17:23+00:00| seen| https://t.me/cibsecurity/10860 2026-06-25 08:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mp3xx7lmzn2i...

CVE-2019-12121

An issue was detected in ONAP Portal through Dublin. By executing a padding oracle attack using the ONAPPORTAL/processSingleSignOn UserId field, an attacker is able to decrypt arbitrary information encrypted with the same symmetric key as UserId. All Portal setups are affected...

PT-2020-9295

Name of the Vulnerable Software and Affected Versions ONAP APPC versions through Dublin ONAP SDC versions through Dublin Description An issue allows an attacker to impersonate an arbitrary existing user without authentication by setting the USER ID parameter in an HTTP header. All APPC and SDC...

CVE-2020-9465

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the userid field in a cookie...

PT-2020-20678

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3 Description An issue was discovered in the eonweb web interface, which is prone to a SQL injection. This allows an unauthenticated attacker to perform various tasks, such as...

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin) Exploit

Exploit for php platform in category web applications Exploit Title: Business Live Chat Software 1.0 - Cross-Site Request Forgery Add Admin Description: Operator Can Change Role User Type to admin Exploit Author: Meisam Monsef Vendor Homepage: https://www.bdtask.com/business-live-chat-software.ph...