Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were addressed in IBM Observability with Instana in build 1.285.0 Vulnerability Details CVEID:CVE-2021-40690 DESCRIPTION: Apache Santuario XML Security for Java could allow a remote attacker to bypass security restrictions, caused by the improper passing of the...

CVE-2024-47533: Improper Authentication

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

PT-2024-8393

Name of the Vulnerable Software and Affected Versions Cobbler versions 3.0.0 through 3.2.2 Cobbler versions 3.3.0 through 3.3.6 Description The issue is related to an improper authentication vulnerability in Cobbler, a Linux installation server. This vulnerability allows anyone with network acces...

CVE-2024-52518: Improper Authentication

Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...

CVE-2024-11209

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2024-11209 Apereo CAS 2FA login improper authentication

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2024-11209 Apereo CAS 2FA login improper authentication

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2024-11209

The connected documents confirm a vulnerability in Apereo CAS 6.6 within the 2FA login flow, specifically affecting the /login?service path. The root cause is described as an improper authentication issue, enabling remote initiation of an attack, with public disclosure of the exploit. All sources...

CVE-2024-11209 Apereo CAS 2FA login improper authentication

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

Improper Authentication

com.baidu.disconf:disconf-core is vulnerable to Improper Authentication. The vulnerability is due to a flaw in the Configuration Center component’s /api/config/list endpoint, which allows remote attackers to bypass authentication...

PT-2024-16826

Name of the Vulnerable Software and Affected Versions Apereo CAS version 6.6 Description A critical issue affects the 2FA component of Apereo CAS, specifically an unknown part of the file /login?service. This leads to improper authentication and can be initiated remotely. The exploit has been...

Apereo CAS Authorization Vulnerability

Apereo CAS is a web-based enterprise multilingual single sign-on solution from Apereo Open Source. An authorization issue vulnerability exists in Apereo CAS version 6.6, which stems from the /login?service page in the 2FA component containing an improper authentication issue...

CVE-2024-11209: Improper Authentication

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

Fortinet Fortigate - Improper authentication in fgfmd (FG-IR-24-032)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-032 advisory. - A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4,...

FortiOS - Improper authentication in fgfmd

...

Improper Authentication

Kyverno is vulnerable to Improper Authentication. The vulnerability is due to the ability to override a ClusterPolicy such as "disallow-privileged-containers" by creating a PolicyException in any namespace. This design flaw allows users with privileges in non-Kyverno namespaces to create...

Improper Authentication

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authentication due to the incorrect application and revocation of matrix room membership and power levels for suspended users. Remediation Upgrade moodle/moodle to version 4.4.2, 4.3.6 or...

Dell Enterprise SONiC OS security vulnerabilities

Dell Enterprise SONiC OS Dell Enterprise Sonic Operating System is an open-source network operating system from Dell USA. A security vulnerability exists in Dell Enterprise SONiC OS versions 4.1. x and 4.2.x, which stems from improper authentication and could lead to a protection mechanism bypass...

CVE-2024-51997: Improper Authentication

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

PT-2024-33296

Name of the Vulnerable Software and Affected Versions Logpoint versions prior to 7.5.0 Description An issue was discovered in Logpoint where unvalidated input during the EventHub Collector setup by an authenticated user leads to Remote Code execution. The issue is related to improper authenticati...