14979 matches found
Design/Logic Flaw
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2023-50771
The vulnerability CVE-2023-50771 affects Jenkins OpenId Connect Authentication Plugin versions 2.6 and earlier. Root cause: the plugin improperly validates the redirect URL after login, allowing an attacker to phishingly redirect to a malicious site instead of Jenkins. Impact (per sources): poten...
CVE-2023-50771
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...
CVE-2023-50770
CVE-2023-50770 affects Jenkins OpenId Connect Authentication Plugin (versions 2.6 and earlier). The root cause is storing a local user password used as an anti-lockout feature in a recoverable format. This enables an attacker with access to the Jenkins controller filesystem to recover the plain t...
PT-2023-28060 · Ivanti · Ivanti Connect Secure
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Description: A vulnerability exists where an attacker impersonating an administrator may craft a specific web request which may lead to remote code execution. Recommendations: For versions prior ...
PT-2023-28062 · Ivanti · Ivanti Connect Secure
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.6R2 Description: A vulnerability exists where an attacker with a foothold on an Ivanti Connect Secure appliance can escalate their privileges by exploiting a vulnerable installed application, allowin...
PT-2023-31640 · Jenkins · Jenkins Openid Connect Authentication Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins OpenId Connect Authentication Plugin versions 2.6 and earlier Description: The issue allows attackers to perform phishing attacks by improperly determining that a redirect URL after login is legitimately pointing to Jenkins...
Jenkins OpenId Connect Authentication Plugin Security Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability ...
Jenkins OpenId Connect Authentication Plugin Security Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. (CVE-2023-3446)
Summary IBM App Connect Enterprise is vulnerable to a denial of service due to OpenSSL. CVE-2023-3446 Vulnerability Details CVEID:CVE-2023-3446 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw when using the DHcheck, DHcheckex or EVPPKEYparamcheck functions to check a D...
CVE-2023-47722
IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912...
CVE-2023-47722
IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912...
Design/Logic Flaw
IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912...
CVE-2023-47722
IBM API Connect vulnerability CVE-2023-47722 affects API Connect versions 10.0.5.3 and 10.0.6.0, where user credentials are stored in the browser cache and can be read by a local user. The issue is described in IBM security advisories and Red Hat/NVD entries, with a base CVSS v3.1 score of 5.5–6....
CVE-2023-47722 IBM API Connect information disclosure
IBM API Connect V10.0.5.3 and V10.0.6.0 stores user credentials in browser cache which can be read by a local user. IBM X-Force ID: 271912...
CVE-2022-39222
A flaw was found in Dex, an identity service that uses OpenID Connect to drive authentication for other apps. This issue may allow an attacker to make a victim navigate to a malicious website and guide them through the OIDC flow, stealing the OAuth authorization code in the process. The...
Software AG webMethods Access Control Error Vulnerability
Software AG webMethods is Software AG's suite of integration and application development tools used to help organizations with tasks such as application integration, data integration, business process management, and application development. webMethods is designed to help organizations better...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. (CVE-2023-38039)
Summary The OpenTelemetry tracing in IBM App Connect Enterprise is vulnerable to a denial of service due to cURL libcurl. CVE-2023-38039 Vulnerability Details CVEID:CVE-2023-38039 DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by not limiting the number and size of headers...
Security Bulletin: API Connect V10 is vulnerable to credential exposure
Summary IBM API Connect V10 stores user credentials in browser cache which can be read by a local user CVE-2023-47722 Vulnerability Details CVEID:CVE-2023-47722 DESCRIPTION: IBM API Connect V10 stores user credentials in browser cache which can be read by a local user. CVSS Base score: 6.2 CVSS...
