Reddit: Third party app could steal access token as well as protected files using inAppBrowser

Summary: Reddit android app version : 2021.8.0 OS: Android 11 This app uses com.reddit.frontpage.RedditDeepLinkActivity class to route app links including deeplink and reddit.com links while this class does not check for scheme, host and it opens given url in InAppBrowser and IAB have access to...

Starbucks: Japan - CSRF in webapp.starbucks.co.jp with user interaction could leak an access token if the user was not using Chrome

elber discovered a CSRF in webapp.starbucks.co.jp leaked an access token if an authenticated user opened a crafted HTML file in a browser other than Chrome which has Same Site Attribute for the cookie set by default. elber also demonstrated the ability to add a Starbucks card to the account with...

Gitlab-Watchman - Monitoring GitLab For Sensitive Data Shared Publicly

GitLab Watchman is an application that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally. Features It searches GitLab for internally shared projects and looks at: Code Commits Wiki pages Issues Merge requests Milestones For the following data: GCP keys and...

JetBrains TeamCity Improper Privilege Control Vulnerability

TeamCity is a Java-based build management and continuous integration server from JetBrains. A privilege control impropriety vulnerability exists in JetBrains TeamCity versions prior to 2020.2.1 that stems from a user being able to access another user's GitHub access token. No details of the...

CVE-2021-25774

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user...

CVE-2021-25774

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user...

CVE-2021-25774

JetBrains TeamCity prior to 2020.2.1 is affected by CVE-2021-25774, where a user could obtain another user’s GitHub access token due to improper privilege checks. Red Hat and CNVD entries corroborate the same flaw in pre-2020.2.1 TeamCity. The JetBrains security bulletin notes the issue was fixed...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in...

PT-2021-16786

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.1 Description The issue allows a user to gain access to the GitHub access token of another user. Recommendations For versions prior to 2020.2.1, update to version 2020.2.1 or later to resolve the iss...

CVE-2021-25774: Incorrect Authorization

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user...

Shopify: [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege

Summary: A low privilege user both in the shop and in the POS can read POS PINs via graphql and elevate his privilege with a physical access to the POS. Steps To Reproduce: 1. Log in to your shop and install the POS app https://apps.shopify.com/shopify-pos 2. Log in Shopify Plus as an org owner a...

Red Hat Keycloak Access Control Error Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An access control error vulnerability exists in Red Hat Keycloak before version 13.0.0, which originates from a user being able to access...

CVE-2020-1725

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token...

CVE-2020-1725

CVE-2020-1725 affects Keycloak up to version 13.0.0, where after changing role mappings and token expiry a user may retain access to resources. The underlying issue is improper revocation/refresh handling that allows continued access despite role-change and token expiration. Affected product: Key...

CVE-2020-1725: Incorrect Authorization

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token...

PT-2021-10083

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 13.0.0 Description: A flaw was found in Keycloak where a user may still have access to a resource after changing the role mappings and after the expiration of the previous access token. Recommendations: For versions...

Shopify: Github access token exposure

While dissecting an application made by one of your employees I found his GitHub Personal Access Token PAT, he's a member of the org with pull and push access to all of your repositories. As a proof I can tell you that on the repo github.com/Shopify/shopify at commit hash cea9c273391d the sha512 ...

CVE-2021-21246 Pre-Auth Access token leak

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the /users/id endpoint there are no security checks enforced so it is possible to retrieve...

FreeBSD : Gitlab -- vulnerability (0a8ebf4a-5660-11eb-b4e2-001b217b3468)

SO-AND-SO reports : Ability to steal a user's API access token through GitLab Pages C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2021 Jacques Vidrine and contributors Redistribution and use ...

CVE-2021-21246: Missing Authorization

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the /users/id endpoint there are no security checks enforced so it is possible to retrieve...