14138 matches found
Juniper Junos OS Vulnerability (JSA100098)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100098 advisory. - An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the Junip...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987142)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987142 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use memset avoid memory leaks Use memset to initialize structs to prevent memory leaks...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-387873)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-387873 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snduna is properly initialized on connect This is strictly related to commit...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986355)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986355 advisory. In the Linux kernel, the following vulnerability has been resolved: net/nfc: fix use-after-free llcpsockbind/connect Commits 8a4cd82d nfc: fix refcount leak in...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414529)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414529 advisory. A use-after-free read flaw was found in sockgetsockopt in net/core/sock.c due to SOPEERCRED and SOPEERGROUPS race with listen and connect in the Linux kernel. In thi...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414569)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414569 advisory. A use-after-free flaw was found in the Linux kernels Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987165)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987165 advisory. In the Linux kernel, the following vulnerability has been resolved: net/nfc: fix use-after-free llcpsockbind/connect Commits 8a4cd82d nfc: fix refcount leak in...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414681)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414681 advisory. A memory leak vulnerability was found in Linux kernel in llcpsockconnect Tenable has extracted the preceding description block directly from the Unity Linux security...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-386613)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-386613 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for connrspepid in htcconnectservice I found the following bug in my...
SUSE CVE-2025-39950
In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...
GHSA-F2HF-PFRJ-VRM7 XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...
CVE-2025-49594
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594 XWiki OIDC Authenticator vulnerable to creation of token for any user with just `view` right
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
EUVD-2025-32541
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594
Summary : CVE-2025-49594 affects XWiki OIDC. From version 2.17.1 up to, but not including, 2.18.2, any user with VIEW access to another user’s profile can forge a token for that user. If the instance allows token authentication, this enables authentication as any user whose profile is viewable. I...
OpenID Connect 授权问题漏洞
OpenID Connect OIDC is a library open-sourced by XWiki Contrib. Makes XWiki a reusable identity provider for any application. An authorization issue vulnerability exists in OpenID Connect OIDC version 2.17.1 through versions prior to 2.18.2, which stems from a user with view privileges being able...
PT-2025-40900
Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...
RockyLinux 10 : mod_auth_openidc (RLSA-2025:7490)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:7490 advisory. modauthopenidc: modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492 Tenable has extracted the preceding description...
