CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-42357 – DOM based XSS Vulnerability in Apache Knox
https://notcve.org/view.php?id=CVE-2021-42357
When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign. Cuando era usado Apache Knox SSO versiones anteriores a 1.6.1, una petición podía ser diseñada para redirigir a un usuario a una página maliciosa debido a un análisis incorrecto de la URL. Una petición que incluyera un parámetro de petición especialmente diseñado podría ser usada para redirigir al usuario a una página controlada por un atacante. • http://www.openwall.com/lists/oss-security/2022/01/17/2 https://lists.apache.org/thread/b7v5dkpyqb51nw0lvz4cybhgrfhk1g7j • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1920
https://notcve.org/view.php?id=CVE-2016-1920
Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service. Samsung KNOX 1.0.0 utiliza el certificado compartido en Android, lo que permite a usuarios locales llevar a cabo ataques man-in-the-middle como se demuestra instalando un certificado y ejecutando un servicio VPN. • http://www.securityfocus.com/archive/1/537318/100/0/threaded http://www.securityfocus.com/archive/1/537339/100/0/threaded • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-3996 – KNOX 2.3 Clipboard Data Disclosure
https://notcve.org/view.php?id=CVE-2016-3996
ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application. ClipboardDataMgr en Samsung KNOX 1.0.0 y 2.3.0 no verifica adecuadamente a quien llama, lo que permite a usuarios locales leer datos de portapapeles de KNOX a través de una aplicación manipulada. KNOX versions 1.0 through 2.3 on Android suffer from a clipboard data disclosure vulnerability. • http://packetstormsecurity.com/files/136710/KNOX-2.3-Clipboard-Data-Disclosure.html http://www.securityfocus.com/archive/1/538113/100/0/threaded • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 1CVE-2016-1919 – Samsung KNOX 1.0 Weak eCryptFS Key Generation
https://notcve.org/view.php?id=CVE-2016-1919
Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack. Samsung KNOX 1.0 utiliza un algoritmo de generación eCryptFS Key débil, lo que hace más fácil a usuarios locales obtener información sensible aprovechando el conocimiento de la clave TIMA y un ataque de fuerza bruta. Samsung KNOX version 1.0 suffers from a weak eCryptFS implementation. • http://lists.openwall.net/bugtraq/2016/01/17/2 http://packetstormsecurity.com/files/135303/Samsung-KNOX-1.0-Weak-eCryptFS-Key-Generation.html http://www.securityfocus.com/archive/1/537319/100/0/threaded http://www.securityfocus.com/archive/1/537340/100/0/threaded • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues •