Archive
4 May 2020
Vulnerabilities first published on this day (UTC), newest first.
11 results · Clear filters · Feed
-
Medium 4.1
Keycloak users may be able to remove MFA from other users' devices
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices fo…
-
Medium 5.3
A use-after-free flaw was found in the way samba AD DC LDAP servers, handled 'Paged Results' control is combined with t…
-
Medium 5.0
RSA Archer, versions prior to 6.7 P2 (6.7.0.2), contain a cross-site request forgery vulnerability. A remote unauthenti…
-
Medium 4.6
RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL redirection vulnerability. A remote unauthenticated attac…
-
Medium 4.6
RSA Archer, versions prior to 6.7 P1 (6.7.0.1), contain a URL injection vulnerability. An unauthenticated attacker coul…
-
Medium 4.3
RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an authorization bypass vulnerability in the REST API. A remote…
-
Medium 4.2
A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security ident…
-
Medium 6.5
Out-of-bounds read in TensorFlow possibly causing disclosure of the contents of process memory.
TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process memory. This occurs in the DecodeBmp feature of the BMP decoder in core/kernels/decode_bmp_op.cc.
-
Medium 5.4
IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to traverse directories on the system. An…
-
Medium 4.2
Buffer Overflow in Google Earth Pro
A Buffer Overflow vulnerability in the khcrypt implementation in Google Earth Pro versions up to and including 7.3.2 allows an attacker to perform a Man-in-the-Middle attack using a specially crafted key to read data past the end of the buffer used to hold it…
-
Medium 5.4
Cross-site scripting in Apache Syncome EndUser
It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.