Xen Orchestra auth bypass exploited to take over XCP-ng hosts
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
Stories per day · 30 days
1 stories, newest first · one card per story
1 stories, newest first · one card per story
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
Today 680 readers · 799 views · 262 reads · all time 187K views