11887 matches found
CVE-2023-41070
A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access sensitive data logged when a user shares a link...
The vulnerability of the system check function of the Cisco IOS XR allows a hacker to execute arbitrary code.
The vulnerability of the Cisco IOS XR operating system’s check function is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow a perpetrator to execute arbitrary code on the base operating system...
Apple iOS and iPadOS Security Vulnerabilities
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS 17 and iPadOS 17, which stems from an application that may be able to access...
PT-2023-17138
Name of the Vulnerable Software and Affected Versions OpenStack Barbican affected versions not specified Description A vulnerability was found in OpenStack Barbican containers, applicable only to deployments utilizing an all-in-one configuration. Barbican containers share the same CGROUP, USER, a...
Shared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting
Description The plugin does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts. PoC Upload an allowed WordPress extension such as JPG and inject it with a script such as: . To access...
The vulnerability in the Firefox web browser, related to the simultaneous execution using a shared resource with incorrect synchronization, allows attackers to gain access to confidential data, compromise its integrity, and cause service interruptions.
The vulnerability in the Firefox web browser relates to the simultaneous execution of operations using a shared resource with incorrect synchronization. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptio...
SUSE CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
SUSE CVE-2023-43621
An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments...
GHSA-55WP-3PQ4-W8P9 Jenkins temporary plugin file created with insecure permissions
Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...
Jenkins temporary uploaded file created with insecure permissions
In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, uploaded files processed via the Stapler web framework and the Jenkins API MultipartFormDataParser create temporary files in the system temporary directory with the default permissions for newly created files. If these permissions are overly...
Jenkins temporary plugin file created with insecure permissions
Jenkins creates a temporary file when a plugin is deployed directly from a URL. Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates this temporary file in the system temporary directory with the default permissions for newly created files. If these permissions are overly permissive, they m...
CVE-2022-3916
A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...
CVE-2022-3916
A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...
CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens
A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...
CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens
A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...
GHSA-HP56-XVF4-G6WR Cros secrets may be disclosed to untrusted relay
An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
Cros secrets may be disclosed to untrusted relay
An issue was discovered in Croc before 9.6.16. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...
CVE-2023-43617
An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name...