GHSA-RQW2-HHRF-7936 OpenStack Keystone does not check signature TTL of the EC2 credential auth method

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times...

GHSA-23X9-8HXR-978C OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

The memcache token backend in OpenStack Identity Keystone 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being...

Unspecified Vulnerability in Nextcloud (CNVD-2021-51799)

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server versions prior to 19.0.13, 20.011, and 21.0.3, which stems from the fact that the webauthn token is not...

OPENSUSE-SU-2021:0898-1 Security update for chromium

This update for chromium fixes the following issues: Chromium 91.0.4472.114 boo1187481 CVE-2021-30554: Use after free in WebGL CVE-2021-30555: Use after free in Sharing CVE-2021-30556: Use after free in WebAudio CVE-2021-30557: Use after free in TabGroups Chromium 91.0.4472.106 Fix use-after-free...

GHSA-P2J5-3F4C-224R Improper Input Validation in HashiCorp Consul

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent...

Centreon Web Cross-Site Request Forgery Vulnerability

Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A cross-site request forgery vulnerability exists in Centreon-Web in Centreon Platform version 20.10...

Information disclosure

The mintToken function of a smart contract implementation for GOAL Bonanza GOAL, a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to increase the total supply of the digital assets arbitrarily so as to make profits, aka the "tradeTrap" issue...

Legal Robot: Password reset token issue

Hi Team, Step to Repro Request for password reset link. Go to email and click on password reset link https://app.legalrobot.com/password-reset/token?v=gHonjdcdLTpmax2pHSXtaRlQrs2eHpTl7TXUpMfjjh Now remove the token and use the link https://app.legalrobot.com/password-reset/ Observe that able to...

Legal Robot: Password reset token issue

Summary Can still change password without token Step to Reproduce - Request for password reset link. - Go to email and click on password reset link https://app.legalrobot.com/password-reset/token?v=uWeyFJS0-N9fIk0nG0b0NZ70lkwNNi7RdUZu0KhiaX - Now remove the token and use the link...

Boozt Fashion AB: Password reset token issue

Hi Team, Step to Repro - Request for password reset link. - Go to email and click on password reset link https://www.boozt.com/eu/en/customer/reset-password/c55ae0b6e00e883238d81e9a5a5d9ff1 - Now remove the token and use the link https://www.boozt.com/eu/en/customer/reset-password Observe that ab...

Access Restriction Bypass Due To Web Service Access Token Issue

Moodle is vulnerable to access restriction bypass. The vulnerability exists because it does not restrict the running of functions from any external services which are not linked to the web service access token. Using this flaw, an authenticated user can run any arbitrary functions from any extern...

CVE-2016-2041

libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences...

CVE-2016-2039

libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value...

OkCupid: Instagram Authentication - No Request Token

Hello, On OkCupid, you have the ability to connect your Instagram account. This will sync any photos from your account onto your profile. This is performed by browsing to https://www.okcupid.com/okphotos/okinstagram.html, which will redirect to Instagram for the user to authorise the request. Onc...