87 matches found
OpenStack Swauth Authentication Bypass Vulnerability
OpenStack is a cloud platform management project developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Swauth is one of the licensing systems.OpenStack Swift is a cloud storage software for retrieving large amounts of data. A security...
PYSEC-2017-84
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving unhashed tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allow...
UBUNTU-CVE-2017-16613
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving unhashed tokens retrieved from the Swauth middleware authentication mechanism to a log file as part of a GET URI. This allow...
CVE-2017-16570
KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF parameter and value, aka SecureLayer7 issue number SL7KEYJS03. In other words, it fails to reject requests that lack an x-csrf-token header...
Cross-site Request Forgery (CSRF)
github.com/openshift/origin is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible because it does not check the X-CSRF-Token header of requests...
Project avatar resource vulnerable to XSRF
The project avatar resource accepts content type of MULTIPARTFORMDATA so a malicious attacker could use javascript to submit a form from a foreign host to a stash server and trick the user into changing the project avatar in Stash. cc David Black Atlassian - is there any reason why panopticon fou...
DEBIAN-CVE-2012-5533
The httprequestsplitvalue function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service infinite loop via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header...