CVSS: 6.1EPSS: 15%CPEs: 1EXPL: 0CVE-2021-42357 – DOM based XSS Vulnerability in Apache Knox
https://notcve.org/view.php?id=CVE-2021-42357
17 Jan 2022 — When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign. Cuando era usado Apache Knox SSO versiones anteriores a 1.6.1, una petición podía ser diseñada para redirigir a un usuario a... • http://www.openwall.com/lists/oss-security/2022/01/17/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-1920
https://notcve.org/view.php?id=CVE-2016-1920
27 Jan 2017 — Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service. Samsung KNOX 1.0.0 utiliza el certificado compartido en Android, lo que permite a usuarios locales llevar a cabo ataques man-in-the-middle como se demuestra instalando un certificado y ejecutando un servicio VPN. • http://www.securityfocus.com/archive/1/537318/100/0/threaded • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2016-3996 – KNOX 2.3 Clipboard Data Disclosure
https://notcve.org/view.php?id=CVE-2016-3996
17 Apr 2016 — ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application. ClipboardDataMgr en Samsung KNOX 1.0.0 y 2.3.0 no verifica adecuadamente a quien llama, lo que permite a usuarios locales leer datos de portapapeles de KNOX a través de una aplicación manipulada. KNOX versions 1.0 through 2.3 on Android suffer from a clipboard data disclosure vulnerability. • https://packetstorm.news/files/id/136710 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 2CVE-2016-1919 – Samsung KNOX 1.0 Weak eCryptFS Key Generation
https://notcve.org/view.php?id=CVE-2016-1919
18 Jan 2016 — Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack. Samsung KNOX 1.0 utiliza un algoritmo de generación eCryptFS Key débil, lo que hace más fácil a usuarios locales obtener información sensible aprovechando el conocimiento de la clave TIMA y un ataque de fuerza bruta. Samsung KNOX version 1.0 suffers from a weak eCryptFS implementation. • https://packetstorm.news/files/id/135303 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-310: Cryptographic Issues •