7286 matches found
Privilege Escalation
firefox is vulnerable to privilege escalation. A malicious extension is able to call browser.identity.launchWebAuthFlow and control the redirecturi. Subsequently, the Auth code can be retrieved and access to user's account is obtained...
mysql: Server: Pluggable Auth unspecified vulnerability (CPU Jul 2020)
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are 5.7.30 and prior and 8.0.20 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MyS...
RHEL 8 : mysql:8.0 (RHSA-2020:3757)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3757 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and...
Important: Red Hat Security Advisory: mysql:8.0 security update
An update for the mysql:8.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
ALSA-2020:3732 Important: mysql:8.0 security update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql 8.0.21. Security Fixes: mysql: Server: Security: Privileges multiple...
mysql:8.0 security update
An update is available for mecab-ipadic, mecab, mysql. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list MySQL is a multi-user, multi-threaded SQL database server...
Important: mysql:8.0 security update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. The following packages have been upgraded to a later upstream version: mysql 8.0.21. Security Fixes: mysql: Server: Security: Privileges multiple...
Oracle Linux 8 : dovecot (ELSA-2020-3713)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3713 advisory. - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts 1866755 - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation...
dovecot: Out of bound reads in dovecot NTLM implementation
A flaw was found in dovecot. An out-of-bounds read flaw was found in the way dovecot handled NTLM authentication allowing an attacker to crash the dovecot auth process repeatedly preventing login. The highest threat from this vulnerability is to system availability...
Oracle Linux 7 : dovecot (ELSA-2020-3617)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3617 advisory. - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts 1871841 - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation...
Cross site scripting
A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field...
openSUSE Security Update : ldb / samba (openSUSE-2020-1313)
"This update for ldb, samba fixes the following issues : Changes in samba : - Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; bso14364 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted...
The vulnerability of the auths/spa.c and auths/auth-spa.c components of the Exim mail server allows a hacker to gain access to confidential data.
The vulnerability of the auths/spa.c and auths/auth-spa.c components of the Exim mail server is related to reading data from buffers beyond their allowed limits. Exploiting this vulnerability could allow an attacker to gain access to confidential data...
Security update for ldb, samba (important)
openSUSE Security Update: Security update for ldb, samba Announcement ID: openSUSE-SU-2020:1313-1 Rating: important References: 1141320 1162680 1169095 1169521 1169850 1169851 1171437 1172307 1173159 1173160 1173161 1173359 1174120 Cross-References: CVE-2020-10700 CVE-2020-10704 CVE-2020-10730...
Server secret was included in static assets and served to clients
Impact Server JWT signing secret was included in static assets and served to clients. This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface which is unprotected and ALLOWS arbitrary code execution and usually wide-ranging privileges ...
CVE-2020-5924
In BIG-IP APM versions 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2, RADIUS authentication leaks memory when the username for authentication is not set...
CVE-2020-16251
HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1...
Denial Of Service (DoS)
MySQL is vulnerable to denial of service DoS due to flaws in Pluggable Auth...
User Impersonation
github.com/concourse/dex is vulnerable to user impersonation. The vulnerability exists when the GitLab auth connector is used, through configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under users...