1045 matches found
CVE-2021-45778
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
GHSA-XHW6-HJC9-679M Pac4j token validation bypass if OpenID Connect provider supports none algorithm
If an OpenID Connect provider supports the “none” algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorit...
Pac4j token validation bypass if OpenID Connect provider supports none algorithm
If an OpenID Connect provider supports the “none” algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the “idtoken” response type which is not secure and violates the OpenID Core Specification. The "none" algorit...
Insecure Token
Pac4j has insecure token. The vulnerability exists due to an insecure validation of ID token with "none" algorithm allowing an attacker to bypass the token validation by injecting a maliciously crafted ID token by setting the alg key = "none"...
CVE-2021-44878
If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorit...
CVE-2021-44878
If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorit...
CVE-2021-44878
If an OpenID Connect provider supports the "none" algorithm i.e., tokens with no signature, pac4j v5.3.0 and prior does not refuse it without an explicit configuration on its side or for the "idtoken" response type which is not secure and violates the OpenID Core Specification. The "none" algorit...
BELL-CVE-2021-45469 CVE-2021-45469 does not affect BellSoft software
Bulletin has no description...
Exploit for Path Traversal in Grafana
grafanaExp 利用grafana CVE-2021-43798任意文件读漏洞，自动探测是否有漏洞、存在的plugi...
Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition
Description Very low severity CSRF in /comments/thanks/id Proof of Concept CLICK ME! Impact This vulnerability is capable of tricking users to send quick thanks. Can potentially trick users to infringe rate limits and get themselves banned via a repeated CSRF attack if admins choose to set...
CVE-2021-41071
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...
CVE-2021-41720
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2021-31149
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...
CVE-2021-31123
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...
CVE-2021-31129
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...
CVE-2021-31138
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...
CVE-2021-31101
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...
CVE-2021-31113
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by the CVE program. Notes: none...