Ivanti Neurons OIDC Man-in-the-Middle

The vulnerability of the OpenID Connect OIDC implementation in the IT service management tool Ivanti Neurons for ITSM is related to improper verification of certificates. Exploiting this vulnerability could allow a malicious actor to execute a “man-in-the-middle” attack...

GHSA-2X2G-32R7-P4X8 Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also...

CVE-2024-31141

Apache Kafka Clients (versions 2.3.0 through 3.5.2, 3.6.2, and 3.7.0) are vulnerable to an improper privilege management flaw. The software includes ConfigProvider plugins, specifically FileConfigProvider , DirectoryConfigProvider , and EnvVarConfigProvider , which allow reading from the disk or ...

Siemens SINEMA Remote Connect Privilege Escalation

The vulnerability of the Siemens SINEMA Remote Connect server is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

io.debezium:debezium-microbenchmark (0.8.2), org.apache.pulsar:pulsar-io-debezium (>=2.3.0, <=2.3.2) +1 more potentially affected by CVE-2023-1419 via io.debezium:debezium-connector-mysql (0.8.2)

io.debezium:debezium-connector-mysql MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-connector-mysql and may be impacted: - io.debezium:debezium-microbenchmark 0.8.2 - org.apache.pulsar:pulsar-io-debezium =2.3.0...

io.debezium:debezium-connect-rest-extension (1.9.1.final), io.debezium:debezium-connector-db2 (1.9.1.final) +36 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.9.1.final)

io.debezium:debezium-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connect-rest-extension 1.9.1.final - io.debezium:debezium-connector-db2 1.9.1.fina...

com.turbospaces.boot:bootstrap-debezium-core (>=1.0.60, <=1.0.63), io.debezium:debezium-connect-rest-extension (1.8.1.final) +39 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.8.1.final)

io.debezium:debezium-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - com.turbospaces.boot:bootstrap-debezium-core =1.0.60, =1.0.63 -...

io.debezium:debezium-connect-rest-extension (1.9.0.alpha2), io.debezium:debezium-connector-db2 (1.9.0.alpha2) +22 more potentially affected by CVE-2023-1419 via io.debezium:debezium-core (1.9.0.alpha2)

io.debezium:debezium-core MAVEN version 1.9.0.alpha2 is affected by a known vulnerability. The following packages have a transitive dependency on io.debezium:debezium-core and may be impacted: - io.debezium:debezium-connect-rest-extension 1.9.0.alpha2 - io.debezium:debezium-connector-db2...

CVE-2024-52512

useroidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. It is recommended that the Nextcloud User OIDC app is upgraded to 6.1.0...

Ivanti Connect Secure Out-of-Bounds Read Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from an out-of-bounds read vulnerability...

Ivanti Connect Secure Buffer Overflow Vulnerability

Ivanti Connect Secure is an enterprise-grade SSL VPN remote access solution for securely connecting to corporate resources over an encrypted channel, with support for a zero-trust architecture and multiple deployment options. Ivanti Connect Secure suffers from a buffer overflow vulnerability that...

PT-2024-35351 · Nextcloud · Nextcloud User Oidc

Name of the Vulnerable Software and Affected Versions: Nextcloud User OIDC app versions prior to 6.1.0 Description: A malicious user could send a malformed login link that would redirect the user to a provided URL after successfully authenticating. This issue is related to the user oidc app, an...

Pulse Connect Secure < 9.1R18.7 / < 22.7R2.1 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 9.1R18.7 or 22.7R2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy...

Pulse Connect Secure < 22.7R2.1 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - Argument injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version...

Pulse Connect Secure < 22.6R2.0 (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.6R2.0. It is, therefore, affected by a vulnerability as referenced in the 000096001 advisory. - Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 and Ivanti Policy Secure before version 22.6R1...

Pulse Connect Secure < 22.7R2.3 Multiple Vulnerabilities (000096001)

The version of Pulse Connect Secure installed on the remote host is prior to 22.7R2.3. It is, therefore, affected by multiple vulnerabilities as referenced in the 000096001 advisory. - An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker ...

Jenkins OpenId Connect Plugin Auth Bypass

The vulnerability of the Jenkins OpenId Connect plugin is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass the authentication process remotely...

NGINX OpenID Connect Session Management

The vulnerability of the authentication module through the OpenID Connect protocol in NGINX web servers is related to improper session management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the application by intercepting sessions...

Siemens SINEMA Remote Connect DoS

The vulnerability of the Siemens SINEMA Remote Connect web interface is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Siemens SINEMA Remote Connect Unauthorized Access

The vulnerability of the Siemens SINEMA Remote Connect server is related to incorrect authorization. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to groups of participants to which they do not have access...