1870 matches found
CVE-2023-22481
CVE-2023-22481 affects FreshRSS with its greader API. The failure paths unauthorized()/badRequest() print debugInfo(), which returns the request content, causing passwords or API keys to be logged in clear in users/_/log_api.txt (and optionally syslog if COPY_LOG_TO_SYSLOG is true). Exploitation ...
CVE-2023-22481 Sensitive information exposure in the logs of greader API in FreshRSS
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users//logapi.txt in the case where the authentication fails. The issues occurs in authorizationToUser in greader.php. If there is an issue with the request or the credentials,...
CVE-2023-26468
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
Design/Logic Flaw
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
CVE-2023-26468
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
CVE-2023-26468
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
CVE-2023-26468: Undefined Security Weakness
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
CVE-2023-26468
Cerebrate 1.12 does not properly consider organisationid during creation of API keys...
SUSE CVE-2019-7628
Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates, so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in...
SUSE CVE-2020-7009
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...
SUSE CVE-2020-7014
The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2023:0362-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0362-1 advisory. - Version update from 8.5.13 to 8.5.15 jscPED-2617: CVE-2022-39306: Security fix for privilege...
Design/Logic Flaw
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...
CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...
CVE-2023-23132
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys...
CVE-2023-23132
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys...
Hardcoded credentials
Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys...
PT-2023-18852
Name of the Vulnerable Software and Affected Versions Selfwealth iOS mobile App version 3.3.1 Description The issue concerns the disclosure of sensitive keys. Specifically, the application reveals hardcoded API keys. Recommendations For Selfwealth iOS mobile App version 3.3.1, consider restrictin...
