135 matches found
EUVD-2022-0670
Malicious code in bioql PyPI...
EUVD-2022-0668
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2016-2860
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypass intended access...
CVE-2023-6717
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...
PT-2024-1836 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, which may allow a remote unauthenticated attacker to block other accounts from logging in under certain conditions. This issue is related to an overly...
Elasticsearch 8.8.2, 7.17.11 Security Update
Elasticsearch Denial of Service DoS issue ESA-2023-10 This issue only affects users that have at least one OpenID Connect authentication realm or at least one JWT authentication realm configured. A denial of service vulnerability was discovered in Elasticsearch that could lead to the service...
K15784: Kerberos vulnerability CVE-2013-1418
Security Advisory Description The setupserverrealm function in main.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted...
SUSE CVE-2013-1418
The setupserverrealm function in main.c in the Key Distribution Center KDC in MIT Kerberos 5 aka krb5 before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted request...
Exposure of Sensitive Information in Apache Tomcat
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /jsecuritycheck with malformed URL encoding of passwords, related to improper error checking in the 1...
@agoric/cosmic-swingset (>=0.10.8 <=0.18.0), @agoric/ertp (>=0.1.4 <=0.4.1) +18 more potentially affected by CVE-2021-23543 via realms-shim (=1.2.2)
realms-shim NPM version =1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6, =0.0.1-alpha2,...
GHSA-Q4J7-V27R-FGCX Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
@agoric/cosmic-swingset (>=0.10.8 <=0.18.0), @agoric/ertp (>=0.1.4 <=0.4.1) +18 more potentially affected by CVE-2021-23594 via realms-shim (=1.2.2)
realms-shim NPM version =1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on realms-shim and may be impacted: - @agoric/cosmic-swingset =0.10.8, =0.1.4, =0.0.1, =0.1.1, =0.0.1, =0.0.20, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.4.1, =0.0.6, =0.0.1-alpha2,...
Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
GHSA-PWM7-QR6J-3VJG Prototype Pollution in realms-shim
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...
Prototype Pollution
realms-shim is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor, and prototype. and bypass the sandbox...
Sandbox Bypass
realms-shim is vulnerable to sandbox bypass. The vulnerability exists through the 'realmEvaluate' function in 'realm.js' as its does not properly validate the input, allowing an attacker bypass the sandbox by inject properties into existing construct prototypes...
CVE-2021-23594
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector...