KB5001339: Windows 10 version 1803 Security Update (April 2021)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Win32k Elevation of Privilege Vulnerability CVE-2021-27072, CVE-2021-28310 - Windows Media Photo Codec Information Disclosure Vulnerability CVE-2021-27079 - Windows Event Tracing Elevati...

Open Redirection

github.com/pomerium/pomerium is vulnerable to open redirect. Lack of verification of pomeriumsignature affects routes responsible for sign in/out. However, it does not introduce an authentication bypass...

CVE-2021-29652

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

CVE-2021-29652

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

Open redirect

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

CVE-2021-29652

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

CVE-2021-29652

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

CVE-2021-29652: URL Redirection to Untrusted Site

Pomerium from version 0.10.0-0.13.3 has an Open Redirect in the user sign-in/out process...

PT-2021-18384 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions 0.10.0 through 0.13.3 Description: The issue is related to an Open Redirect in the user sign-in/out process. Some API endpoints under /.pomerium/ do not verify parameters with pomerium signature, which could allow modifying...

CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

Authentication flaw

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2021-24148

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2021-24148

CVE-2021-24148 affects the WordPress plugin MStore API (vulnerable:

CVE-2021-24148 MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

CVE-2021-24148: Improper Authentication

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address...

PT-2021-15694

Name of the Vulnerable Software and Affected Versions: MStore API WordPress plugin versions prior to 3.2.0 Description: A business logic issue in the MStore API WordPress plugin allows for an authentication bypass with Sign In With Apple. This issue enables unauthenticated users to recover an...

February 24, 2021—KB4601382 (OS Builds 19041.844 and 19042.844) Preview

None None...

CVE-2021-21310 Token verification bug in next-auth

NextAuth.js next-auth is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. PoC The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header...