SUSE SLED15: libzbar-devel / libzbar0 / libzbar0-32bit / libzbarqt-devel / etc (SUSE-SU-2023:4948-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4948-1 advisory. - CVE-2023-40889: Fixed heap-based buffer overflow in the qrreadermatchcenters function...

Duplicate Advisory: Keycloak Open Redirect vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients...

GHSA-3P75-Q5CC-QMJ7 Duplicate Advisory: Keycloak Open Redirect vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients...

PT-2023-32821 · Imou · Imou Life

Name of the Vulnerable Software and Affected Versions: Imou Life version 6.7.0 Description: A session hijacking issue has been detected in the Imou Life application. This issue could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when...

CVE-2023-6927

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

Design/Logic Flaw

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

CVE-2023-6927 Keycloak: open redirect via "form_post.jwt" jarm response mode

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

CVE-2023-6927 Keycloak: open redirect via "form_post.jwt" jarm response mode

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

CVE-2023-6927

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134. Mitigation Mitigation for this issue ...

CVE-2023-6920

An incomplete fix was found in the Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt". Changing the responsemode parameter in the original proof of concept from "formpost" to "formpost.jwt" can bypass the...

PT-2023-32823 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, which may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form post.jwt". This could be used...

Red Hat Keycloak Input Validation Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak suffers from an input validation error vulnerability that stems from a vulnerability that could allow an attacker to steal...

PT-2023-31411 · Elastic · Agent +2

Name of the Vulnerable Software and Affected Versions: Beats versions prior to 7.17.16 Beats versions prior to 8.11.3 Elastic Agent versions prior to 7.17.16 Elastic Agent versions prior to 8.11.3 Description: An issue was discovered whereby Beats and Elastic Agent would log a raw event in its ow...

Scanning Danger: Unmasking the Threats of Quishing

Scanning Danger: Unmasking the Threats of Quishing By Shyava Tripathi and Rohan Shah · December 7, 2023 This blog was also written by Raghav Kapoor Phishing, a prevalent cybercrime worldwide, is responsible for as much as 90 percent of data breaches, making it a significant avenue for the theft o...

Scanning Danger: Unmasking the Threats of Quishing

Scanning Danger: Unmasking the Threats of Quishing By Shyava Tripathi, Raghav Kapoor and Rohan Shah · December 07, 2023 Phishing, a prevalent cybercrime worldwide, is responsible for as much as 90 percent of data breaches, making it a significant avenue for the theft of sensitive credentials and...

The vulnerability of the web service journal of the Splunk Enterprise platform for operational analysis allows a perpetrator to execute arbitrary code.

The vulnerability of the log service of the Splunk Enterprise platform for operational analysis is related to the improper processing of log output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP request containing ANSI...

CVE-2023-48863

SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements...

Debian dla-3675 : libbarcode-zbar-perl - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3675 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3675-1 [email protected]...

How to Not Get Hacked by a QR Code

QR codes can be convenient—but they can also be exploited by malicious actors. Here’s how to protect yourself...

Code injection

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten and a user clicks the link to a malicio...