Auth.js SDK has Improper Permission Checking

Description Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided. Am I Affected? Users are affected if they meet each of the following preconditions: - Applications built...

CVE-2026-4820

CVE-2026-4820 affects IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10, where authorization tokens or session cookies are not marked with the Secure attribute. This can allow an unauthenticated attacker to steal cookie values by directing users to an http link and monitoring traffic, enablin...

CVE-2026-4820 IBM Maximo Application Suite was vulnerable to because Cookie ltpatoken2_<workspace_name> was not set with secure flag

IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses keras-2.14.0-py3-none-any.whl which is vulnerable to CVE-2024-55459.

Summary IBM Maximo Application Suite - Monitor Component uses keras-2.14.0-py3-none-any.whl which is vulnerable to CVE-2024-55459. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2024-55459 DESCRIPTION: An issue in keras 3.7.0 allows attackers to...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses tar-fs-2.1.3.tgz which is vulnerable to CVE-2025-59343.

Summary IBM Maximo Application Suite - Monitor Component uses tar-fs-2.1.3.tgz which is vulnerable to CVE-2025-59343. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-59343 DESCRIPTION: tar-fs provides filesystem bindings for...

CVE-2018-3149 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

CVE-2018-2678 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

CVE-2016-3508 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

GHSA-CJG9-H8WQ-J253 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

GHSA-78GW-5P6W-HW23 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

CVE-2025-27113 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

CVE-2022-21541 vulnerabilities

Vulnerabilities for packages: openjdk-8-openj9, openjdk-21-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-25-openj9...

PT-2025-7871 · Aldo Latino · Privatecontent

Name of the Vulnerable Software and Affected Versions: Aldo Latino PrivateContent versions through 8.11.5 Description: The issue is related to an Authentication Bypass Using an Alternate Path or Channel. This allows unauthorized access, potentially compromising the security of the system...

UBUNTU-CVE-2024-55634

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

CVE-2022-48111

A cross-site scripting XSS vulnerability in the checklogin function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter...

Square OkHttp can accept the wrong certificate

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Vulnerabilities fixed in Google Android

Google has fixed vulnerabilities in the Android OS. A malicious party could misuse the vulnerabilities to gain access to sensitive data or give himself elevated privileges. To do this, the malicious party must trick the victim into installing a rogue app to install. The vulnerability with referen...

Google Android 信息泄露漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the Media Framework component of Google Android versions 8.1, 9, 10, and 11, which can be exploited by an attacker...

Google Android 输入验证错误漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. A remote code execution vulnerability exists in the System component of Google Android 8.1, 9, 10, and 11. An attacker can exploit this vulnerability to achieve...

Google Android 缓冲区错误漏洞

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the System component of Google Android 8.1, 9, 10, and 11. An attacker can exploit the vulnerability to obtain...