457 matches found
Atlassian Crowd < 2.11.2 OAuth Plugin IconUriServlet Internal Network Resource Disclosure CSRF
The version of Atlassian Crowd installed on the remote host is prior to 2.11.2. It is, therefore, affected by a internal network resource disclosure CSRF vulnerability in the OAuth plugin IconUriServlet. Note that Nessus has not tested for this issue but has instead relied only on the application...
SQL Injection Vulnerability in State Micro CMS School Crowd System
State Micro CMS formerly PHP168 S series is a leading manufacturer of domestic government, school and group platforms, and is also the largest open source system provider in the field of PHP in southern China. State Micro CMS school station group system has SQL injection vulnerability, attackers...
SQL Injection Vulnerability in State Micro CMS School Crowd System
State Micro CMS formerly PHP168 S series is a leading manufacturer of domestic government, school and group platforms, and is also the largest open source system provider in the field of PHP in southern China. State Micro CMS school station group system has SQL injection vulnerability, attackers...
Police locate suspect from a crowd of 60,000 using Facial Recognition
By Carolina In Southeast China, the police used facial recognition tech to This is a post from HackRead.com Read the original post: Police locate suspect from a crowd of 60,000 using Facial Recognition...
The console login did not rotate the session id during login - CVE-2017-18105
The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...
The console login did not rotate the session id during login - CVE-2017-18105
The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation...
Various resources included the current remote directory password in their responses - CVE-2016-10740
Various resources in Atlassian Crowd before before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories via examining the responses of various resources...
Various resources included the current remote directory password in their responses - CVE-2016-10740
Various resources in Atlassian Crowd before before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories via examining the responses of various resources...
The bundled version of atlassian-rest had a weakness in its Cross-site request forgery protection
The bundled version of atlassian-rest in Atlassian Crowd before version 2.8.4 and from version 2.9.0 before version 2.9.1 was vulnerable to a Cross-site request forgery CSRF vulnerability in certain browsers, for example chrome, due to an assumption that non-simple content-types could not be sent...
New Mac cryptominer has 23 older variants
On February 1, a new Mac cryptominer was discovered being distributed via a hack of the MacUpdate website. Since then, we've been doing some digging and found that this isolated incident was just the tip of the iceberg. The malware delivered by the MacUpdate hack appears to be the culmination of...
Atlassian Crowd crowd-application plugin module user forgery vulnerability
Atlassian Crowd is a web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization and other functions for multiple users, web applications and directory servers. crowd-application plugin module is one of the SSO management plugin. A security...
CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
Design/Logic Flaw
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
CVE-2017-16858
The CVE-2017-16858 issue affects Atlassian Crowd’s crowd-application plugin (used by Google Apps) where versions 1.5.0–3.1.1 allow impersonation of a Crowd user in REST requests by authenticating to a directory bound to an application. In the described scenario, if Crowd is bound to directory 1 w...
CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
REST endpoint user impersonation using authentication module functionality - CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
REST endpoint user impersonation using authentication module functionality - CVE-2017-16858
The 'crowd-application' plugin module notably used by the Google Apps plugin in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST requests by being able to authenticate to a directory bound to an application using the feature. Given th...
WordPress Crowd Ideas 1.0 Cross Site Scripting Vulnerability
WordPress Crowd Ideas plugin version 1.0 suffers from a cross site scripting vulnerability. Credit Ricardo Sanchez Vulnerable Crowd Ideas 1.0 Crowd Ideas is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage...
WordPress Crowd Ideas 1.0 Cross Site Scripting
Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Crowd Ideas 1.0 Crowd Ideas is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...