GHSA-F66Q-9RF6-8795 Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion

Summary Flask-Security-Too 5.8.0 and 5.8.1 mark a session as reauthentication-fresh after processing a WebAuthn assertion whose proven credential belongs to a different user than the currently authenticated session user. The check that GHSA-97r5-pg8x-p63p added on the OAuth reauthentication path...

EUVD-2023-43010

Malicious code in bioql PyPI...

CVE-2023-39278

SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash...

Stack overflow

SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash...

CVE-2023-39278

SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash...

CVE-2023-39278

CVE-2023-39278 is a SonicOS vulnerability in which a post-authentication user assertion failure in main.cgi leads to a Stack-Based Buffer Overflow and a firewall crash. The connected sources corroborate that SonicOS Management Web Interface and SSLVPN portal are affected by multiple related post-...

CVE-2023-39278

SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash...

SonicWALL SonicOS Buffer Error Vulnerability

SonicWALL SonicOS is an operating system from SonicWALL, Inc. designed for SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from a user assertion failure and a stack-based buffer overflow vulnerability in main.cgi that causes the firewall to crash...

Internet Bug Bounty: Cross-site information assertion leak via Content Security Policy

It is possible to test for the satisfaction of certain assertions across origins by abuse of Content Security Policy. These could be assertions such as 'is the client logged into this website', or 'is the client logged in as this user', or 'does the client have access to these panels'. This gener...