CVE-2023-50708 yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison...

CVE-2023-50708: Observable Discrepancy

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 state and OpenID Connect nonce is vulnerable for a timing attack since it is compared via regular string comparison...

Ivanti Connect Secure 9.1Rx < 9.1R18.5 / 22.x < 22.4R1.1 / 22.5Rx < 22.5R2.3 / 22.6Rx < 22.6R2.2 Multiple Vulnerabilities

The Ivanti Connect Secure installed on the remote host is 9.1Rx prior to 9.1R18.5, 22.x prior to 22.4R1.1, 22.5Rx prior to 22.5R2.3, or 22.6Rx 22.6R2.2. It is, therefore, affected by multiple vulnerabilities. - A vulnerability exists on both branches of Ivanti Connect Secure 9.1Rx and 22x below...

GHSA-W8VH-P74J-X9XP yii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation

Impact What kind of vulnerability is it? Who is impacted? Original Report: The Oauth1/2 "state" and OpenID Connect "nonce" is vulnerable for a "timing attack" since it's compared via regular string comparison instead of Yii::$app-getSecurity-compareString. Affected Code: 1. OAuth 1 "state"...

CVE-2023-39340

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

CVE-2023-39340

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

Design/Logic Flaw

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

CVE-2023-39340

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

CVE-2023-39340

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

CVE-2023-39340

Ivanti Connect Secure is affected on all versions below 22.6R2 where an attacker can send a specific request that may lead to a Denial of Service (DoS) of the appliance. The issue is confirmed across multiple advisories (CVE-2023-39340) and is addressed by upgrades to patched releases: 22.x (e.g....

PT-2023-26887 · Ivanti · Ivanti Connect Secure

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Description: A vulnerability exists where an attacker can send a specific request, potentially leading to Denial of Service DoS of the appliance. Recommendations: For versions prior to 22.6R2,...

Ivanti Connect Secure Security Vulnerability

Ivanti Connect Secure is a secure remote network connection tool from Ivanti Corporation, USA. A security vulnerability exists in versions prior to Ivanti Connect Secure 22.6R2 that stems from the presence of a Denial of Service DoS vulnerability...

CVE-2023-39340: Undefined Security Weakness

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service DoS of the appliance...

GHSA-5968-QW33-H47J Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cvg2-7c3j-g36j. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended t...

MSC-2023-18370

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

MSC-2023-18368

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

CVE-2023-49749: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in SureTriggers SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!.This issue affects SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything!: from n/a through 1.0.23...

MSC-2023-18369

@ledgerhq/connect-kit allows web3 apps to connect to Ledger hardware wallets. Versions 1.1.5, 1.1.6, 1.1.7 were compromised by a threat actor to include malicious code that automatically steals crypto and NFT's from wallets that connect to the app. Those versions were deleted and we recommend...

keycloak: reflected XSS via wildcard in OIDC redirect_uri

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting XSS or further attacks. This flaw is the result of an incomple...

keycloak: reflected XSS via wildcard in OIDC redirect_uri

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting XSS or further attacks. This flaw is the result of an incomple...