2331 matches found
Improper Authorization
Overview All versions of passport-cognito are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may...
CVE-2019-14782
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/accesslog, then use them to make a request to extract the victim's password for the OS...
Mail.ru: Leak Sensetive Data at face.city-mobil.ru
Unrestricted git directory in face.city-mobil.ru could leak sensitive data including access token for internal repository...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
Security feature bypass
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
CVE-2013-4593 concerns the RubyGem omniauth-facebook. The connected sources describe a flaw where the access token can be transmitted via the URL, enabling a remote attacker to bypass authentication and impersonate another user. This results in an authentication bypass vulnerability within the om...
CVE-2019-1458
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ‘Win32k Elevation of Privilege Vulnerability’. Recent assessments: gwillcox-r7 at October 19, 2020 5:31pm UTC reported: Known as WizardOpium for its use in the...
Picsart: User account compromised authentication bypass via oauth token impersonation
OAuth token impersonation is actually a bug when 3rd party company app or malicious app collects the access token of the same user then that company can access to user account on PicsArt. The condition is that the user needs to authorized both PicsArt and malicious app with same Facebook or Googl...
CVE-2019-14365
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14366
WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14367
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14367
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14365
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
Code injection
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
Design/Logic Flaw
Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14365
The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...
CVE-2019-14365
The CVE-2019-14365 entry concerns the WordPress Intercom plugin (versions around 1.2.1/1.2.2). The vulnerability is a leakage of a Slack Access Token embedded in the plugin’s source code, enabling an attacker to access Slack-related data (channels, members, etc.). Details across connected sources...