CVE-2023-6837

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

CVE-2023-6837

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

Authentication flaw

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

CVE-2023-6837

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

CVE-2023-6837

CVE-2023-6837 concerns multiple WSO2 products where, under specific federated authentication and JIT provisioning configurations, an attacker could impersonate another user. The vulnerable setup requires: (1) an IDP configured for federated authentication with JIT provisioning enabled and the pro...

CVE-2023-6837 Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

CVE-2023-6837: Incorrect Authorization

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with...

PT-2023-32785 · Wso2 · Wso2

Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: The issue allows a malicious actor to perform user impersonation using JIT provisioning under specific conditions. These conditions include an IDP configured for federated...

php:php-fuzz-function-jit: Heap-use-after-free in zend_reference_destroy

Detailed Report: https://oss-fuzz.com/testcase?key=6034106571685888 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-function-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x60800000cf40 Crash State: zendreferencedestroy...

webkit2gtk3 security and bug fix update

2.40.5-1 - Upgrade to 2.40.5. Also, disable JIT Resolves: 2176269 Resolves: 2185742 Resolves: 2209728 Resolves: 2209745 Resolves: 2218649 Resolves: 2218651 Resolves: 2224611 2.38.5-1.4 - Add patch for CVE-2023-28204 Resolves: 2209744 - Add patch for CVE-2023-32373 Resolves: 2209727 2.38.5-1.3 -...

php:php-fuzz-tracing-jit: Crash in php_strip_url_passwd

Detailed Report: https://oss-fuzz.com/testcase?key=4681096453029888 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-tracing-jit Job Type: libfuzzerasani386php Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0xab2196eb Crash State: phpstripurlpasswd phpmessagehandlerforzen...

CVE-2023-45140

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

Authorization

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140 Group-based JIT MFA bypass on scp and sftp in The Bastion

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140 Group-based JIT MFA bypass on scp and sftp in The Bastion

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

CVE-2023-45140: Missing Authentication for Critical Function

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnorm...

Rocky Linux 8 : pcre (RLSA-2021:4373)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:4373 advisory. - libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related...

PT-2023-35555 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This can lead to a crash. The error is specifically...

php:php-fuzz-function-jit: Segv on unknown address in ZEND_HANDLE_EXCEPTION_SPEC_HANDLER

Detailed Report: https://oss-fuzz.com/testcase?key=5308354391834624 Project: php Fuzzing Engine: libFuzzer Fuzz Target: php-fuzz-function-jit Job Type: libfuzzerasanphp Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: ZENDHANDLEEXCEPTIONSPECHANDLER zero zendexecu...