VMware Spring Security 安全漏洞

VMware Spring Security is a suite of security frameworks from VMware that provide illustrative security protections for Spring-based applications. A security vulnerability exists in Spring Security that allows an attacker to send multiple requests to initiate authorization requests granted by the...

The vulnerability in Microsoft SharePoint Foundation software, related to errors in processing authentication requests for applications, allows a hacker to perform cross-site forgery of these requests.

The vulnerability of Microsoft SharePoint Foundation’s electronic document management software is related to errors in processing authorization requests for applications. Exploiting this vulnerability can allow a malicious actor to perform cross-site forgery of authorization requests remotely...

The vulnerability of the Azure DevOps Server software lies in its shortcomings in handling authorization requests. This allows attackers to perform cross-site forgery of these requests.

The vulnerability of the Azure DevOps Server software lies in its shortcomings in processing authorization requests for applications. Exploiting this vulnerability allows a malicious actor to perform cross-site forgery of authorization requests remotely...

Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Hardcoded credentials

Dahua DVR appliances have a hardcoded password for 1 the root account and 2 an unspecified "backdoor" account, which makes it easier for remote attackers to obtain administrative access via authorization requests involving a ActiveX, b a standalone client, or c unknown other vectors...

USN-1117-1: PolicyKit vulnerability

Neel Mehta discovered that PolicyKit did not correctly verify the user making authorization requests. A local attacker could exploit this to trick pkexec into running applications with root privileges...