Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

LFI in PHP-Proxy 5.1.0

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" intended for users who lack shell access to their web server is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 appkey value from the default config.php is in place, and this value ca...

GHSA-PC5H-M95G-V6RH LFI in PHP-Proxy 5.1.0

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" intended for users who lack shell access to their web server is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 appkey value from the default config.php is in place, and this value ca...

AZL-8704 CVE-2020-25719 affecting package samba 4.12.5-7

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result cou...

Twisted 信息泄露漏洞

Twisted is an event-driven open source web engine written in Python. An information disclosure vulnerability exists in Twisted that originates from exposing cookies and authorization information during cross-origin redirects...

CVE-2022-22832

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request...

CVE-2022-22832

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request...

CVE-2022-22832

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request...

Design/Logic Flaw

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request...

CVE-2022-22832

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/users/ request...

PT-2022-15700 · Servisnet · Servisnet Tessa

Name of the Vulnerable Software and Affected Versions: Servisnet Tessa version 0.0.2 Description: An issue was discovered where authorization data is available via an unauthenticated request to the "/data-service/users/" API endpoint. Recommendations: For Servisnet Tessa version 0.0.2, consider...

CVE-2021-3910

OctoRPKI crashes when encountering a repository that returns an invalid ROA just an encoded NUL \0 character...

Design/Logic Flaw

Specific versions of the MongoDB C Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser",...

Authorization

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...

The vulnerability of the krb_parse_authz_data function in the SnAuthRPC module of the Secret Net Studio security system allows a hacker to trigger a service failure.

The vulnerability of the krbparseauthzdata function in the SnAuthRPC module of the Secret Net Studio security system is related to buffer overflow attacks. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...

The vulnerability of the krb_parse_authz_data function in the SnAuthRPC module of the Secret Net Studio security system allows a hacker to trigger a service failure.

The vulnerability of the krbparseauthzdata function in the SnAuthRPC module of the Secret Net Studio security system is related to the lack of checks for the execution of the memory allocation command. Exploitation of this vulnerability could allow a malicious actor to cause service failures...

PT-2019-5406 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions: openshift-online-3, openshift-enterprise-3.4 through 3.7, openshift-enterprise-3.9 through 3.11 Description: A reflected XSS issue exists in the authorization flow, allowing an attacker to steal...

PHP-Proxy Weak Encryption Vulnerability

PHP-Proxy is a web-based proxy script featuring fast, easy customization and the ability to provide support for complex websites such as YouTube and Facebook. A weak encryption vulnerability in the strrotpass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy versions 5.1.0 and...

CVE-2018-19784

The strrotpass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier for attackers to calculate the authorization data needed for local file inclusion...

Inadequate Encryption Strength

The strrotpass function in PHP-Proxy uses weak cryptography, which makes it easier for attackers to calculate the authorization data needed for local file inclusion...