Broken Authentication

homeassistant is vulnerable due to Broken Authentication. An attacker could exploit this vulnerability by tricking a user into clicking on a malicious link. The link would direct the user to a malicious website that would initiate the OAuth2 login process with a specially crafted redirect URI. If...

CVE-2023-41893

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PYSEC-2023-214

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

Design/Logic Flaw

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41893

CVE-2023-41893 affects Home Assistant Core. The vulnerability arises because the login flow allows altering redirect_uri and client_id, causing the code parameter used to fetch the access_token to be sent to a URL controlled by an attacker. This enables an account-takeover attempt if a victim aut...

CVE-2023-41893 Account takeover via auth_callback login in Home Assistant Core

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PT-2023-27088 · Unknown · Kaibutsunosato

Name of the Vulnerable Software and Affected Versions: Kaibutsunosato version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Kaibutsunosato version 13.6.1, update to a version that...

Kaibutsunosato security breach

Kaibutsunosato is an application. A security vulnerability exists in Kaibutsunosato version v13.6.1, which stems from an information disclosure vulnerability in the client. An attacker can exploit the vulnerability to obtain a channel access token and send a crafted broadcast message...

CVE-2023-39731

The CVE-2023-39731 entry concerns Kaibutsunosato v13.6.1, where leakage of the client secret enables attackers to obtain the channel access token and issue crafted broadcast messages. Public sources in the connected documents consistently describe an information-disclosure flaw in the client that...

Scripts failing intermittently due to permissions denied (401) exception while using PAT

h3. Issue Summary This is reproducible on the Data Center: Yes h3. Steps to Reproduce Create two Jira users: UserA and UserB and two Projects: ProjectA and ProjectB. Restrict access to ProjectA for UserA, and ProjectB for UserB. Create one issue each on ProjectA and ProjectB. Use the below python...

CVE-2023-1584

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

CVE-2023-43297

An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...

CVE-2023-43297

An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...

Code injection

An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...

CVE-2023-43297

CVE-2023-43297 affects animal-art-lab v13.6.1. The issue allows attackers to trigger crafted notifications via leakage of the channel access token, enabling a potential leakage/unauthorized notification flow. Public sources in the provided documents consistently describe the vulnerability as stem...

CVE-2023-43297

An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...

CVE-2023-43297

An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token...

Animal-art-lab Security Breach

animal-art-lab is an application. A security vulnerability exists in Animal-art-lab version v13.6.1, which stems from a vulnerability that allows an attacker to send a notification by revealing the access token of a channel...