CVE-2019-12419: Incorrect Authorization

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

PT-2019-11846 · Jenkins · Jenkins View26 Test-Reporting Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins View26 Test-Reporting Plugin affected versions not specified Description: The issue concerns the storage of sensitive information in an unencrypted manner. Specifically, the Jenkins View26 Test-Reporting Plugin stores credentials and ...

elasticbox stores access token in plain text

elasticbox stores an access token unencrypted in the global config.xml configuration file on the Jenkins controller. This token can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory there is no fix...

view26 stores access token in plain text

view26 stores an access token unencrypted in job config.xml files on the Jenkins controller. This token can be viewed by users with Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory there is no fix...

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Moodle Code Issue Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A code issue vulnerability exists in Moodle that can be exploited by an attacker to obtain a user's mobile access token...

CVE-2016-10986

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumerkey, consumersecret, accesstoken, and accesstokensecret...

PT-2019-7779

Name of the Vulnerable Software and Affected Versions tweet-wheel plugin versions prior to 1.0.3.3 Description The issue allows for XSS attacks via the consumer key, consumer secret, access token, and access token secret variables. Recommendations For versions prior to 1.0.3.3, update to version...

CloudBees Jenkins Google Kubernetes Engine Plugin Information Disclosure Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Google Kubernetes Engine Plugin is used in whi...

GSA Bounty: Stealing Users OAuth Tokens through redirect_uri parameter

I found that https://login.fr.cloud.gov/oauth/authorize has vulnerability by open redirect on oauth redirecturi which can lead to users oauth tokens being leaked to any malicious user. Step : 1, Clicked on link...

CVE-2019-10365

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

CVE-2019-10365

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

Code injection

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

CVE-2019-10365

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

CVE-2019-10365

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

CVE-2019-10365

The CVE-2019-10365 entry concerns Jenkins Google Kubernetes Engine Plugin (versions 0.6.2 and earlier). The underlying issue is that the plugin creates a temporary file containing a temporary access token in the project workspace, exposing it to users with Job/Read permission. Documents from RH R...

PT-2019-11761 · Jenkins · Jenkins Google Kubernetes Engine Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Google Kubernetes Engine Plugin versions 0.6.2 and earlier Description: The issue concerns the creation of a temporary file containing a temporary access token in the project workspace, which could be accessed by users with Job/Read...

CVE-2019-10365: Exposure of Resource to Wrong Sphere

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission...

Authentication flaw

Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms...

CVE-2019-13483

Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms...