35 matches found
Brute-Force Attack
keycloak is vulnerable to brute-force attack. The failedLogin event is not sent to the BruteForceProtector when using Post Login Flow with Conditional-OTP, allowing an attacker to attempt multiple authentications and discover user credentials...
Deleting a user in an external security realm did not invalidate their session or 'Remember me' cookie
When using an external security realm such as LDAP or Active Directory, deleting a user from the security realm does not result in the user losing access to Jenkins. While deleting the user record from Jenkins did invalidate the 'Remember me' cookie, there was no way to invalidate active sessions...
SUSE SLED15 / SLES15 Security Update : samba (SUSE-SU-2018:4066-1)
This update for samba fixes the following issues : Update to samba version 4.7.11. Security issues fixed : CVE-2018-14629: Fixed CNAME loops in Samba AD DC DNS server bsc1116319. CVE-2018-16841: Fixed segfault on PKINIT when mis-matching principal bsc1116320. CVE-2018-16851: Fixed NULL pointer...
SUSE SLED12 / SLES12 Security Update : samba (SUSE-SU-2018:3161-1)
"Samba was updated to 4.6.15, bringing bug and security fixes. bsc1110943 Following security issues were fixed : CVE-2018-10919: Fix unauthorized attribute access via searches. bsc1095057 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...
SUSE-SU-2018:3161-1 Security update for samba
Samba was updated to 4.6.15, bringing bug and security fixes. bsc1110943 Following security issues were fixed: - CVE-2018-10919: Fix unauthorized attribute access via searches. bsc1095057; Non-security bugs fixed: - Fix ctdbmutexcephradoshelper deadlock bsc1102230. - Allow idmaprid to have primar...
Mexico’s Banking System Sees $18M Siphoned Off in Phantom Transactions
Somewhere between $18 million to $20 million has gone missing during unauthorized interbank money transfers in Mexico’s central banking system. Authorities are investigating the shadow transactions, but answers are thus far scarce. The affected banks and government officials are determining wheth...
FreeBSD : krb5 -- Vulnerabilities in kadmind, libgssrpc, gss_process_context_token VU#540092 (24ce5597-acab-11e4-a847-206a8a720317)
SO-AND-SO reports : CVE-2014-5352: In the MIT krb5 libgssapikrb5 library, after gssprocesscontexttoken is used to process a valid context deletion token, the caller is left with a security context handle containing a dangling pointer. Further uses of this handle will result in use-after-free and...
CVE-2013-7366
The SAP Software Deployment Manager SDM, in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications...
Design/Logic Flaw
The SAP Software Deployment Manager SDM, in certain unspecified conditions, allows remote attackers to cause a denial of service via vectors related to failed authentications...
PT-2014-3397
Name of the Vulnerable Software and Affected Versions SAP Software Deployment Manager SDM affected versions not specified Description The issue allows remote attackers to cause a denial of service, related to failed authentications. Recommendations At the moment, there is no information about a...
Oracle Linux 6 : openssh (ELSA-2013-0519)
The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0519 advisory. 5.3p1-84.1 - Add a 'netcat mode' ssh -W 860809 5.3p1-83 - fix the required authentications patch 869903 5.3p1-82 - check return value of PK11Authenticate in...
Ubuntu Update for firefox vulnerabilities USN-535-1
Ubuntu Update for Linux kernel vulnerabilities USN-535-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN5351.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for firefox vulnerabilities USN-535-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...
Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : mozilla-thunderbird, thunderbird vulnerabilities (USN-536-1)
Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5339, CVE-2007-5340 Flaws were discovered in the file upload form control. By tricking a user int...
USN-535-1: Firefox vulnerabilities
Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5336, CVE-2007-5339, CVE-2007-5340 Michal Zalewski discovered that the onUnload event handlers we...
