7941 matches found
CVE-2020-27978
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session...
CVE-2020-14768
Vulnerability in the Hyperion Analytic Provider Services product of Oracle Hyperion component: Smart View Provider. The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to t...
CVE-2018-14991
The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of...
CVE-2019-19191
Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...
CVE-2019-20576
An issue was discovered on Samsung mobile devices with P9.0 software. The MemorySaver Content Provider allows SQL injection. The Samsung ID is SVE-2019-14365 August 2019...
CVE-2019-14408
cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...
Privilege Escalation
github.com/gardener/gardener is vulnerable to Privilege Escalation. The vulnerability is due to improper authorization checks due to the gardenlet component allowing project administrators to gain control over seed clusters managing their shoot clusters in environments using...
CVE-2015-9435
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
CVE-2018-20523
Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query...
CVE-2017-1000104
The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with only Overall/Read access to Jenkins were able to access URLs directly that allowed viewing these files. Access to view these files now requires sufficient...
CVE-2009-5085
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...
SUSE CVE-2025-46735
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version 1.0.5. The windnsrecord resource did not sanitize the input variables. This could lead to authenticated command...
mod_auth_openidc security update
2.4.10-1.el96.1 Resolves: RHEL-86224 - modauthopenidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data CVE-2025-31492...
Malicious code in web3-provider-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc3ff80c31877ea658c6e65be0a05a240bf2a26f8c84e19e2dc75e88abbcd6c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-4054 Malicious code in web3-provider-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc3ff80c31877ea658c6e65be0a05a240bf2a26f8c84e19e2dc75e88abbcd6c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Evaluating the Efficacy of LLM Safety Solutions : the Palit Benchmark Dataset
Large Language Models LLMs are increasingly integrated into critical systems in industries like healthcare and finance. Users can often submit queries to LLM-enabled chatbots, some of which can enrich responses with information retrieved from internal databases storing sensitive data. This gives...
Privilege Chaining
Overview Affected versions of this package are vulnerable to Privilege Chaining via the handling of DNS secrets. An attacker can escalate privileges by supplying malicious Google credentials. Note: Upgrading to 1.23.6 will fix the vulnerability in most cases, but not when the extension...
CVE-2025-47884
In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunction with certain other plugins allowing attackers able to configure jobs to craft a build ID Token that impersonates a...
GO-2025-3670 Terraform WinDNS Provider improperly sanitizes input variables in `windns_record` in github.com/nrkno/terraform-provider-windns
Terraform WinDNS Provider improperly sanitizes input variables in windnsrecord in github.com/nrkno/terraform-provider-windns...