198 matches found
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...
Dynatrace OneAgent 安全漏洞
Dynatrace OneAgent is an intelligent agent program from Dynatrace, Inc. A security vulnerability exists in Dynatrace OneAgent versions prior to 1.325.47, which stems from the fact that the agent retrieves every user token on a machine and attempts to access a network share when it receives a...
About the security content of visionOS 26.2
About the security content of visionOS 26.2 This document describes the security content of visionOS 26.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
CVE-2025-63563
The CVE-2025-63563 affects Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2. The root cause is improper invalidation of active sessions after a password change, enabling an attacker with a valid session token to retain access after the legitimate user changes their password....
CVE-2025-49594
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
EUVD-2021-19388
Malware in sbrugna...
EUVD-2017-0189
Malware in sbrugna...
EUVD-2019-10130
Malware in sbrugna...
EUVD-2018-10124
Malware in sbrugna...
EUVD-2021-2354
Malware in sbrugna...
EUVD-2013-3642
Malware in sbrugna...
EUVD-2018-7620
Malware in sbrugna...
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...
GHSA-F2HF-PFRJ-VRM7 XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Impact Anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows authentication with any user since users are very commonly viewable, at least to other registered users. Patches Version 2.18.2...
CVE-2025-49594
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
EUVD-2025-32541
XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Starting in version 2.17.1 and prior to version 2.18.2, anyone with VIEW access to a user profile can create a token for that user. If that XWiki instance is configured to allow token authentication, it allows...
CVE-2025-49594
Summary : CVE-2025-49594 affects XWiki OIDC. From version 2.17.1 up to, but not including, 2.18.2, any user with VIEW access to another user’s profile can forge a token for that user. If the instance allows token authentication, this enables authentication as any user whose profile is viewable. I...
PT-2025-40900
Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...