Veille cybersécurité : alertes, vulnérabilités, actualités et outils pour se protéger.
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.
Indico is a feature-rich event management system. Indico 3.3.3 through 3.3.13 incorrectly uses the ambient web-session user instead of the user supplied to Contribution.can_manage when checking inherited event contribut…
When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the requested maxAge value. As a result, an application may pro…
When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submit…
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic …
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulne…
ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this…
ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulne…
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unautho…
ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary co…
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute …