2139 matches found
SUSE-SU-2016:1249-1 Security update for subversion
This update for subversion fixes the following issues: - CVE-2016-2167: modauthzsvn: DoS in MOVE/COPY authorization check bsc976849 - CVE-2016-2168: svnserve/sasl may authenticate users using the wrong realm bsc976850 The following non-security bugs were fixed: - bsc969159: subversion dependencie...
Cisco IOS Software SSH Version 2 RSA-Based User Authentication Bypass Vulnerability (cisco-sa-20150923-sshpk)
A vulnerability in the SSH version 2 SSHv2 protocol implementation of Cisco IOS Software could allow an unauthenticated, remote attacker to bypass user authentication. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...
HP Data Protector does not perform authentication and contains an embedded SSL private key
Overview The HP Data Protector does not perform user authentication, even when Encrypted Control Communications is enabled, and contains an embedded SSL private key that is shared among all installations. Description CWE-306: Missing Authentication for Critical Function - CVE-2016-2004Data...
FAQ: Time-Out with Password Caching on XenMobile
Question : What is the expectations of time-outs with the combinations of Enable Password Caching on XenMobile Server? Answer : Enable Password Cache : false Secure PIN authentication on XenMobile Apps after INACTIVITYTIMER expires. Active Directory password authentication on Secure Hub when...
The vulnerability of Cisco ASR 5000 router microprogramming software allows attackers to enhance their privileges.
The vulnerability of the SSH protocol implementation in Cisco ASR 5000 microprogramming software is related to deficiencies in the configuration of multi-user authentication with a public key. Exploiting this vulnerability allows a malicious actor to gain increased privileges by establishing a...
Error: "Incorrect credentials. Try again." when logging into NetScaler Gateway
Users fail to log on to NetScaler Gateway with the following error: "Incorrect credentials. Try again." Log on through StoreFront is successful. From /tmp/aaad.debug, the following is the logon failure message: /usr/home/build/rs1011296/usr.src/usr.bin/nsaaad/../../netscaler/aaad/ldapcommon.c341:...
Zomato: Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow
The zomato.com web application is vulnerable to authentication bypassing and sensitive information disclosure. The flaw exist in “Verify Email Address” link which is received in a mail after registration. Once the user enters Full Name, Email Address and Password during registration, he/she is...
Two factor Authentication
As a company IT administrator of our company I want that all users authenticate to bamboo in two steps username password & app or sms. So that I'm always sure that a employee of our company logs in bamboo instead of a hacker. This makes even my infrastructure more secure...
How to Use sAMAccountName and userPrincipalName at Same Time for User Logon with Active Directory
This article describes how use sAMAccountName and userPrincipalName at same time for user logon with Active Directory. Background While authenticating with LDAP for NetScaler Gateway or any other resource behind the NetScaler, we can only access resources using either 'domain\username' or...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in IBM Flash System V9000 7.4 before 7.4.1.4, 7.5 before 7.5.1.3, and 7.6 before 7.6.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...
Microsoft OAuth interface XSS, affecting user account security-vulnerability warning-the black bar safety net
One day, while I was browsing on Twitter information, I found a very interesting article, Wesley Wineberg in the Microsoft OAuth authentication interface found a CSRF vulnerability. This article makes me curious at the same time also provoked I can be in this place and then find a loophole of fai...
PEAR LiveUser 0.16.8 - Arbitrary File Access
PEAR LiveUser 0.16.8 - Arbitrary File Access PEAR LiveUser Arbitrary File Access Vendor: Markus Wolff Product: PEAR LiveUser Version: options'cookie''name'; if strlen$cookieData deleteRememberCookie; $this-stack-pushLIVEUSERERRORCOOKIE, 'error', array, 'Wrong data in cookie store in...
CVE-2016-1335
The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previous...
[SECURITY] Fedora 22 Update: mingw-curl-7.47.0-1.fc22
cURL is a tool for getting files from HTTP, FTP, FILE, LDAP, LDAPS, DICT, TELNET and TFTP servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL offers many useful capabilities, like proxy support, user authentication, F...
CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005
This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...
CVE-2015-8748
Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by "."...
CVE-2016-1134
The CVE-2016-1134 entry documents a Cross-site request forgery (CSRF) vulnerability affecting BUFFALO network devices (e.g., BHR-4GRV2, WEX-300, WHR-1166DHP, WHR-300HP2, WHR-600D, WMR-300, WMR-433, WSR-1166DHP) with specific firmware versions (e.g., 1.04 and earlier for BHR-4GRV2; 1.90 and earlie...
IBM WebSphere Application Server CSRF Vulnerability (Jan 2016)
IBM WebSphere Application Server is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...
Online Airline Booking System - Multiple Vulnerabilities
Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an all in one solution for an airline wishing to speed up...
