7042 matches found
CVE-2022-39222
Dex is an OpenID Connect identity service. Affected versions prior to 2.35.0 with public clients can have the OAuth authorization code exposed during the OIDC flow when a victim visits a malicious site. An attacker can then exchange the stolen authorization code for a token to gain access to appl...
Dexidp Dex 信息泄露漏洞
Dexidp Dex is a Go-based language used for secure authentication via OpenId by the Dexidp team. Versions of Dex prior to 2.35.0 have a security vulnerability that stems from the fact that its Dex instances with public clients clients that, by extension, accept tokens issued by these Dex instances...
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...
undertow: potential security issue in flow control over HTTP/2 may lead to DOS(incomplete fix for CVE-2021-3629)
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server...
Dex vulnerable to Man-in-the-Middle allowing ID token capture via intercepted authorization code
Impact Dex instances with public clients and by extension, clients accepting tokens issued by those Dex instances are affected by this vulnerability. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the...
GSD-2022-1006335 IB/core: Fix a nested dead lock as part of ODP flow
IB/core: Fix a nested dead lock as part of ODP flow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.9 by commit...
PT-2022-34657 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.143 Description: A potential security issue has been identified in the Linux Kernel, related to a nested dead lock as part of the ODP flow. The actual impact and attack plausibility have not yet been prove...
PT-2022-34630 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.68 Description: A potential security issue has been identified in the Linux Kernel, related to a nested dead lock as part of the ODP flow. The actual impact and attack plausibility have not yet been proven...
GHSA-5W8R-8PGJ-5JMF matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification
Impact An attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one of the users’ identities, leading to the other device trusting/verifying the user identity under the control of th...
What is User Flow and how to make one?
By Owais Sultan User Flow is a technique that allows you to quickly map the entire flow of screens on your… This is a post from HackRead.com Read the original post: What is User Flow and how to make one?...
CVE-2022-39250
Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one o...
DEBIAN-CVE-2022-32166
In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution...
UBUNTU-CVE-2022-32166
In ovs versions v0.90.0 through v2.5.0 are vulnerable to heap buffer over-read in flow.c. An unsafe comparison of “minimasks” function could lead access to an unmapped region of memory. This vulnerability is capable of crashing the software, memory modification, and possible remote execution...
More data flow occupies by PVS server after NAS server failover
To improve NAS server high availability,NAS storage controllers are created as failover group to provide fault tolerance for hardware issues and maintenance tasks. Sometimes, if one NAS storage controller needs to shutdown for maintenance or corrupted due tohardwarefailure, it will failover to...
Open vSwitch 缓冲区错误漏洞
Open vSwitch is an open source virtual switch. A buffer error vulnerability exists in Open vSwitch versions v0.90.0 through v2.5.0, which stems from a heap buffer over-read in flow.c. An unsafe comparison of the minimasks function may result in access to unmapped memory regions, which can be...
CVE-2022-3058
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction...
CVE-2022-3058
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction...
DEBIAN-CVE-2022-3058
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction...