2738 matches found
CVE-2023-32682 Improper checks for deactivated users during login in synapse
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
CVE-2023-32682
Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...
Synapse has improper checks for deactivated users during login
Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...
GHSA-26C5-PPR8-F33P Synapse has improper checks for deactivated users during login
Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...
Fedora: Security Advisory for mod_auth_openidc (FEDORA-2023-b534ca7056)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 38 Update: mod_auth_openidc-2.4.13.2-1.fc38
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server...
Fedora 38 : mod_auth_openidc (2023-b534ca7056)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b534ca7056 advisory. Rebase to 2.4.13.2 version, fix CVE-2023-28625 Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...
Authentication flaw
useroidc app is an OpenID Connect user backend for Nextcloud. Authentication can be broken/bypassed in useroidc app. It is recommended that the Nextcloud useroidc app is upgraded to 1.3.2...
Spring Authorization Server is on Spring Initializr!
Today, I'm excited to announce that you have a new superpower: creating applications with Spring Authorization Server on Spring Initializr! That's right, it's time to begin your OAuth2 journey and become the hero you always knew you could be! In this post, I'll explain how you can get the most fr...
Debian DSA-5405-1 : libapache2-mod-auth-openidc - security update
The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5405 advisory. It was discovered that missing input sanitising in the implementation of the OIDCStripCookie option in modauthopenidc could result in denial of service. For the stable...
K000134597: mod_auth_openidc vulnerability CVE-2023-28625
Security Advisory Description modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer...
The vulnerability of the Git repository management system Gitea, related to insufficient validation of incoming requests, allows a hacker to execute an SSRF attack.
The vulnerability of the Git repository management system Gitea is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack using a specially crafted link based on the OpenID standard...
CVE-2023-2182
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users...
Design/Logic Flaw
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users...
PT-2023-18346 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab EE versions 15.10 through 15.10.4 GitLab EE versions 15.11 through 15.11.0 Description: An issue has been discovered in GitLab EE that may allow users who are marked as external to become regular users under certain conditions when...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from the fact that in som...
CVE-2023-2182
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users...
CVE-2023-2182
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users...
CVE-2023-2182
The CVE-2023-2182 issue affects GitLab EE, specifically versions 15.10 up to 15.10.4 and 15.11 up to 15.11.0. Under certain conditions with OpenID Connect enabled, users marked as 'external' may be promoted to 'regular' users, enabling privilege escalation. The vulnerability is described across m...