CVE-2023-39040

An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

CVE-2023-39056

CVE-2023-39056 affects Coffee-jumbo v13.6.1. The vulnerability is an information leak enabling an attacker to obtain the channel access token and send crafted messages. The available sources confirm the affected product and impact but do not provide root-cause details or mitigations. Exploitation...

CVE-2023-39058

An information leak in THEBmembers card v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

PT-2023-26757 · Unknown · Youmart-Tokunaga

Name of the Vulnerable Software and Affected Versions: youmart-tokunaga version 13.6.1 Description: An information leak in the software allows attackers to obtain the channel access token and send crafted messages. Recommendations: For youmart-tokunaga version 13.6.1, at the moment, there is no...

CVE-2023-39049

An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

PT-2023-26748 · Unknown · Cheese Cafe Line

Name of the Vulnerable Software and Affected Versions: Cheese Cafe Line version 13.6.1 Description: An information leak in Cheese Cafe Line allows attackers to obtain the channel access token and send crafted messages. Recommendations: For version 13.6.1, consider restricting access to sensitive...

CVE-2023-39046

CVE-2023-39046 concerns TonTon-Tei_waiting Line v13.6.1. The documentation describes an information leak that enables an attacker to obtain the channel access token and send crafted messages. No root cause details or patch/fix information are provided in the connected documents. CVSS-like metrics...

Missing Authorization

The Mattermost is vulnerable to Missing Authorization. The vulnerability is due to not invalidating existing authorization codes when deauthorizing an OAuth2 app. This can result in attacker generating an access token by leveraging the existing authorization codes...

CVE-2023-4320

An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker who uses this arithmetic overflow to create personal access tokens that are valid indefinitely, resulting in damage to the system's integrity...

PT-2023-28731 · Satellite · Satellite

Name of the Vulnerable Software and Affected Versions: Satellite affected versions not specified Description: An arithmetic overflow flaw was found in Satellite when creating a new personal access token. This flaw allows an attacker to create personal access tokens that are valid indefinitely,...

CVE-2023-39531 Sentry vulnerable to incorrect credential validation on OAuth token requests

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. Th...

CVE-2023-39531

CVE-2023-39531 affects Sentry. From version 10.0.0 up to, but not including, 23.7.2, an attacker with client-side exploits could obtain a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The attack requires a known client_id and an API ap...

Privilege Escalation

sentry is vulnerable to Privilege Escalation. An authenticated attacker is able to take advantage of an access token with a restricted scope by requesting a list of all user-created tokens, including those with wider scopes from the /api/0/api-tokens/ endpoint, resulting in privilege escalation...

Insufficient Session Expiration

admidio/admidio is vulnerable to Insufficient Session Expiration. The vulnerability exists due to the user cache in Session.php which allows a user to use an access token to login even when its invalid...

CVE-2023-39349 Sentry vulnerable to privilege escalation via ApiTokensEndpoint

Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query /api/0/api-tokens/ for a list of all tokens created by a user, including tokens with greater scopes, and use...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to lack of cascading deletes in GitLab which allows a malicious attacker to retain a usable Group Access Token even after the Group is deleted, though the APIs usable by that token are limited...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. An attacker could gain access to an integration's access token, which could then be used to impersonate the integration and perform unauthorized actions...

Cross-Site Leak

gitlab is vulnerable to Cross-Site Leak. The vulnerability exists in the OAuth flow, allowing an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. This vulnerability occurs when a malicious project maintainer can create a Project Access Token with Owner level privileges which could allow the attacker to take control of the project...

CVE-2023-25524

NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access token is displayed in the browser user's address bar. An attacker could use this token to impersonate the user to access launcher resources. A successful exploit ...