CVE-2021-29676

IBM Security Verify Privilege Vault (10.9.66 and prior releases) is vulnerable to a link-injection flaw. A remote attacker could lure a user into clicking a specially crafted URL, enabling cross-site scripting, cache poisoning, or session hijacking. Affected product facet: IBM Security Verify Pri...

CVE-2021-29676

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site...

CVE-2021-20583

CVE-2021-20583 affects IBM Security Verify Privilege Vault (IBM Security Verify) up to version 10.9.66. The issue is an information disclosure via an HTTP GET request by a privileged user caused by improper input validation in the Privilege Vault component. Impact is exposure of sensitive informa...

Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault

Summary Multiple vulnerabilities identified in IBM Security Verify Privilege Vault previously known as IBM Security Secret Server has been addressed in the release 10.9.66 Vulnerability Details CVEID: CVE-2021-29676 DESCRIPTION: IBM Security Verify is vulnerable to link injection. By persuading a...

PT-2021-3739 · Unknown · Wildfly-Core

Name of the Vulnerable Software and Affected Versions: wildfly-core versions prior to the fixed version Description: The issue is related to flaws in the access control mechanism of the wildfly-core Java application server. This could allow a remote attacker to impact the confidentiality and...

CVE-2021-20583

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 could disclose sensitive information through an HTTP GET request by a privileged user due to improper input validation.. IBM X-Force ID: 199396...

IBM Security Verify 输入验证错误漏洞

IBM Security Verify Privilege Vault is a privileged access management solution that enables IT administrators and IT security professionals to protect the privileges of all services, applications, roots and administrator accounts across the enterprise. An information disclosure vulnerability exis...

CVE-2021-29676

IBM Security Verify IBM Security Verify Privilege Vault 10.9.66 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site...

safeApprove() for Yearn Vault may revert preventing deposits causing DoS

Handle 0xRajeev Vulnerability details Impact The depositInVault function for Yearn yield source uses ERC20 safeApprove from OpenZeppelin's SafeERC20 library to give maximum allowance to the Yearn Vault address if the current allowance is less than contract’s token balance. However, the safeApprov...

Yearn vault withdrawals in redeems will always fail leading to lock/loss of user deposits

Handle 0xRajeev Vulnerability details Impact The withdrawFromVault calculates the token balance of contract before withdrawal and saves it in previousBalance. It then withdraws from the Yearn vault and calculates the token balance after withdrawal to save it in currentBalance. So currentBalance...

Free Photo & Video Vault v0.0.2 - Directory Traversal

Document Title: =============== Free Photo & Video Vault v0.0.2 - Directory Traversal References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2271 Release Date: ============= 2021-06-20 Vulnerability Laboratory ID VL-ID: ==================================== 227...

Invalid session token expiration

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

GHSA-38J9-7PP9-2HJW Invalid session token expiration

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

Users can avoid paying borrowing interest after the fyToken matures

Handle shw Vulnerability details Impact According to the protocol design, users have to pay borrowing interest when repaying the debt with underlying tokens after maturity. However, a user can give his vault to Witch and then buy all his collateral using underlying tokens to avoid paying the...

CVE-2021-32923

A flaw was found in the HashiCorp Vault and Vault Enterprise. The vault could allow a remote attacker to bypass security restrictions caused by a renewal logic flaw when a token lease or dynamic secret lease was renewed inside the last second of its maximum TTL. By sending a specially crafted...

CVE-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

CVE-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

Denial of service

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

CVE-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

CVE-2021-32923

Summary: CVE-2021-32923 affects HashiCorp Vault and Vault Enterprise. The issue arises from the renewal logic for nearly-expired token leases and dynamic secret leases within one second of their maximum TTL, which allowed these leases to be incorrectly treated as non-expiring during subsequent us...