84688 matches found
CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover
Authentication Bypass by Spoofing vulnerability in ueberauth ueberauthapple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback idtoken against Apple's JWKS but does not validate any registered...
EEF-CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover
Summary Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth\apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id\token against Apple's JWKS but does not validate any...
CVE-2026-55954
CVE-2026-55954 affects ueberauth_apple (v0.1.0 up to but not including v0.6.2). The root cause is lack of validation for registered ID token claims (iss, aud, exp, iat) in Ueberauth.Strategy.Apple.Token.payload/2; the code uses the unvalidated sub to derive the user uid and email. An attacker who...
CVE-2026-60114
SIP 5.x (up to 5.2.16) contains a path traversal flaw in the Backup/Restore function. Unvalidated keys in the JSON backup enable attackers with restore access to craft file paths and write JSON files outside the data directory. The issue is worse when the optional passphrase is not enabled (facto...
CVE-2026-58475 Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name
Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network...
Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability
Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally...
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
DNS Client Tampering Vulnerability
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally...
Microsoft SharePoint Elevation of Privilege Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network...
Windows Spaceport.sys Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally...
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Server Update Service allows an authorized attacker to elevate privileges over a network...
Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Routing and Remote Access Service RRAS allows an authorized attacker to elevate privileges locally...
MINI-M5GM-7338-F89G
Bulletin has no description...
MINI-8X7W-HFJ6-V594
Bulletin has no description...
MINI-326Q-C54H-2M4P
Bulletin has no description...
MINI-653V-J5XQ-FM5P
Bulletin has no description...