Design/Logic Flaw

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade...

CVE-2022-24936

CVE-2022-24936 is a vulnerability in Silicon Labs Gecko Bootloader’s GBL parser, affecting Gecko Bootloader versions 4.0.1 and earlier. The issue is an out-of-bounds error in the GBL parser that could let an attacker overwrite critical flash keys (Sign key and OTA decryption key) through a malici...

CVE-2022-24936 Gecko Standalone Bootloader vulnerability may allow bypassing application secure boot in some Series 2 devices

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade...

PT-2022-16996 · Silicon · Gecko Bootloader

Name of the Vulnerable Software and Affected Versions: Silicon Labs Gecko Bootloader versions 4.0.1 and earlier Description: The issue is related to an Out-of-Bounds error in the GBL parser, which allows an attacker to overwrite the flash Sign key and OTA decryption key via a malicious bootloader...

CVE-2022-24936: Improper Restriction of Operations within the Bounds of a Memory Buffer

Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key via malicious bootloader upgrade...

UBUNTU-CVE-2022-39369

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...

编号撤回

easyii CMS is a simple CMS for simple websites developed by individual developer noumo. easyii CMS has a cross-site request forgery vulnerability in the /admin/sign/out file. An attacker can exploit this vulnerability to cause cross-site request forgery...

PT-2022-24047 · Unknown · Easyii Cms

Name of the Vulnerable Software and Affected Versions: easyii CMS affected versions not specified Description: A problematic issue was found in easyii CMS, affecting an unknown function of the file /admin/sign/out, leading to cross-site request forgery. The manipulation can be launched remotely...

CVE-2022-3741

Impact varies for each individual vulnerability in the application. For generation of accounts, it may be possible, depending on the amount of system resources available, to create a DoS event in the server. These accounts still need to be activated; however, it is possible to identify the output...

October 28, 2022—KB5020953 (OS Builds 19042.2194, 19043.2194, 19044.2194, and 19045.2194) Out-of-band

None None...

Default credentials

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on SSO users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions...

Metabase 授权问题漏洞

Metabase is an open source data analytics platform from the US-based Metabase Inc. A security vulnerability exists in Metabase that stems from the ability of single sign-on SSO users to reset their passwords on Metabase, which could allow users to access it without going through the SSO IdP...

PT-2022-24928 · Metabase · Metabase

Name of the Vulnerable Software and Affected Versions: Metabase versions prior to 0.41.9 and 1.41.9 Metabase versions prior to 0.42.6 and 1.42.6 Metabase versions prior to 0.43.7 and 1.43.7 Metabase versions prior to 0.44.5 and 1.44.5 Description: The issue allows single sign on SSO users to...

CVE-2022-39360: Missing Critical Step in Authentication

Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 single sign on SSO users were able to do password resets on Metabase, which could allow a user access without going through the SSO IdP. This issue is patched in versions...

Why Ransomware in Education on the Rise and What That Means for 2023

The breach of LA Unified School District LAUSD highlights the prevalence of password vulnerabilities, as criminal hackers continue to use breached credentials in increasingly frequent ransomware attacks on education. The Labor Day weekend breach of LAUSD brought significant districtwide disruptio...

SSON working if user uses a PIN to logon to client

SSON will not work with CWA Windows Client . Ssonsvr.exe will not launch when the user logs on to the client . SSONMChecker shows this error. SSONCheckerInstallationSingle Sign-on process runningThe Single Sign-on process is not running. Reboot the machine after installing Citrix Workspace to sta...

Security Bulletin: WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to Server-Side Request Forgery (CVE-2022-35282)

Summary IBM Security Access Manager for Enterprise Single Sign-On includes IBM WebSphere Application Server. IBM WebSphere Application Server is vulnerable to Server-Side Request Forgery CVE-2022-35282 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

RHEL 7 : Red Hat Single Sign-On 7.5.3 security update on RHEL 7 (Moderate) (RHSA-2022:6782)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6782 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.5.3 security update on RHEL 8 (Moderate) (RHSA-2022:6783)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6783 advisory. Red Hat Single Sign-On 7.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

Amazon Cognito User Enumeration

Amazon Cognito is a cloud product from Amazon Web Services AWS which provides user authentication, authorization and management services for web and mobile applications. By using Amazon Cognito, developers can quickly add a user management feature to their applications, control and enforce...