GHSA-875X-G8P7-5W27 The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property i...

The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames

Summary The ProfileBasedRequestOptionsBuilder method returns allowedCredentials without any credentials if no username was found. Details When WebAuthn is used as the first or only authentication method, an attacker can enumerate usernames based on the absence of the allowedCredentials property i...

Provisioning Services Target Device Fails to Download tsbbdm.bin

Booting a Provisioning Services PVS target device through the Boot ISO method created by the Boot Device Manager utility fails with the following error: "Downloading tsbbdm.bin from FAILED!"...

CVE-2024-21832

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body...

CVE-2024-21832 PingFederate REST API Data Store Injection

A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body...

CVE-2024-21832

CVE-2024-21832 concerns PingFederate with a potential JSON injection vector in REST API data stores via POST requests carrying a JSON body. Metrics indicate low base score (3.5), network access, high attack complexity, and scope changes with partial integrity impact. No explicit remediation or ex...

CVE-2024-34723

In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2024-21731

Improper handling of input could lead to an XSS vector in the StringHelper::truncate method...

CVE-2023-3288

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

Denial Of Service (DoS)

aimhubio/aim is vulnerable to Denial Of Service DoS. The vulnerability is due to the remote tracking server being configured to point at itself while using the class method Repo.frompath, which allows an attacker to cause the server to endlessly connect to itself and become unable to respond to...

PT-2024-26137 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to a logic error in the code of ParcelableListBinder.java, specifically in the onTransact method. This error could allow an attacker to steal the...

PT-2024-19025 · Joomla +2 · Joomla! +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to improper handling of input, which could lead to a cross-site scripting XSS vector. Specifically, this concerns the...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to escalate privileges due to a logic error in the code in onDransact of ParcelableListBinder.java...

Ping Identity PingFederate Security Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. It is used for identity management. Ping Identity A security vulnerability exists in PingFederate versions prior to 12.0.1 that stems from the presence of a potential JSON injection attack vector using...

Django: SQL injection in JSONField KeyTransform

A vulnerability was discovered in the JSONField KeyTransform functionality of Django. The vulnerability allowed SQL injection attacks by crafting malicious user input for the .values method. The vulnerability was demonstrated in the Django test suite, where a SQL syntax error was triggered by...

CBL Mariner 2.0 Security Update: cri-tools / docker-buildx / kubernetes / opa / prometheus (CVE-2023-45142)

The version of cri-tools / docker-buildx / kubernetes / opa / prometheus installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45142 advisory. - OpenTelemetry-Go Contrib is a collection of third-party...

CVE-2024-38953

The CVE-2024-38953 entry maps to phpok 6.4.003 with a Cross Site Scripting (XSS) vulnerability in the ok_f() method of framework/api/upload_control.php. Affected component: phpok core, file path framework/api/upload_control.php. Root cause and explicit impact are described as XSS, but the connect...

CVE-2024-38953

phpok 6.4.003 contains a Cross Site Scripting XSS vulnerability in the okf method under the framework/api/uploadcontrol.php file...

CVE-2024-38953

phpok 6.4.003 contains a Cross Site Scripting XSS vulnerability in the okf method under the framework/api/uploadcontrol.php file...

PT-2024-28292 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: phpok version 6.4.003 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the ok f method located in the framework/api/upload control.php file. Recommendations: For phpok version 6.4.003, consider disabli...