8 matches found
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /sessionservice endpoint when authenticated users register URLs for session event notifications without sufficient restriction. An attacker can cause the server to make outbound requests to...
GHSA-C556-Q2MH-477V OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice`
OpenAM Open Identity Platform is an open-source Identity and Access Management IAM platform derived from ForgeRock OpenAM, providing SSO, OAuth2, SAML, and OpenID Connect capabilities. It is widely deployed in enterprise environments as a central authentication gateway. The /sessionservice...
CVE-2014-3193
The SessionService::GetLastSession function in browser/sessions/sessionservice.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing...
Type confusion
The SessionService::GetLastSession function in browser/sessions/sessionservice.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing...
CVE-2014-3193
The SessionService::GetLastSession function in browser/sessions/sessionservice.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing...
CVE-2014-3193
CVE-2014-3193 : Affected software is Google Chrome prior to 38.0.2125.101. Root cause is a type confusion issue in SessionService::GetLastSession used during callback processing, which can lead to a use-after-free and potentially other impact. The vulnerability enables denial of service and parti...
CVE-2014-3193
The SessionService::GetLastSession function in browser/sessions/sessionservice.cc in Google Chrome before 38.0.2125.101 allows remote attackers to cause a denial of service use-after-free or possibly have unspecified other impact via vectors that leverage "type confusion" for callback processing...
