Drupal OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login module 3.0.0-3.43.0,4.0.0-4.0.18 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Drupal OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login module 3.0.0-3.43.0,4.0.0-4.0.18 - Unauthenticated Cross Site Scripting XSS vulnerability discovered by Borut Piletic in WordPress Module OAuth & OpenID Connect Login - OAuth2.0 Client SSO Login versions 3.0.0-3.43.0,4.0.0-4.0.18...

IBM App Connect Enterprise Certified Container: Operating System Command Injection Vulnerability

IBM App Connect Enterprise is an operating system from IBM.IBM App Connect Enterprise combines existing industry-trusted IBM Integration Bus technology with IBM App Connect Professional and new cloud-native technologies to provide a platform that meets the comprehensive integration needs of the...

OAuth Client & OpenID Connect SSO | OAuth/OIDC Login - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

This module enables you to authenticate users through an Identity Provider IdP or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is...

Ivanti Connect Secure Policy Secure Code Execution

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Connect Secure Policy Secure Code Execution

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Connect Secure Policy Secure Code Execution

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Connect Secure Policy Secure Code Execution

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Ivanti Connect Secure Policy Secure Code Execution

The vulnerability of Ivanti Connect Secure formerly Pulse Connect Secure and Ivanti Policy Secure lies in the exploitation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-51465: Improper Neutralization of Special Elements used in an OS Command

IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

Important: Red Hat Security Advisory: rhc-worker-playbook security update

An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

UBUNTU-CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

GO-2024-3300 sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies in github.com/drakkan/sftpgo...

GHSA-6943-QR24-82VX sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Impact The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically...

sftpgo vulnerable to brute force takeover of OpenID Connect session cookies

Impact The OpenID Connect implementation, in the affected SFTPGo versions, allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are generated predictably using the xid library and are therefore unique but not cryptographically...

CVE-2024-52801

SFTPGo (CVE-2024-52801) is affected by an OpenID Connect cookie vulnerability in which authenticated users can brute-force session cookies due to predictably generated cookies via the xid library. The issue enables access to other users’ data and is addressed in version 2.6.4, where cookies are m...

CVE-2024-52801 Brute force takeover of OpenID Connect session cookies in sftpgo

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

CVE-2024-52801

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

CVE-2024-52801 Brute force takeover of OpenID Connect session cookies in sftpgo

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

CVE-2024-52801: Use of a Broken or Risky Cryptographic Algorithm

sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other users' data, since the cookies are...

PT-2024-9660 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.6, 11.4.7 and earlier Description: The issue is related to a URL redirection vulnerability to an untrusted site, also known as an "Open Redirect". This could allow a remote attacker to bypass existing security...