CoinMate.io: Adding phone number to profile By OTP brute forcing

A vulnerability was found that allowed an attacker to add any phone number to a user's profile by brute-forcing the one-time password OTP used for phone number verification. The steps involved intercepting the OTP verification request, using a brute-force attack to find the valid OTP, and then...

CVE-2024-27009 s390/cio: fix race condition during online processing

In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix race condition during online processing A race condition exists in ccwdevicesetonline that can cause the online process to fail, leaving the affected device in an inconsistent state. As a result, subsequent attempts...

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

The V3 API in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification 1 GET or 2 HEAD request to v3/auth/tokens/...