GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

Pomerium service account access token may grant unintended access to databroker API

Impact We've identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments. Who is affected? A Pomerium deployment is susceptible to this issue if all of the...

CVE-2024-47077

CVE-2024-47077 affects authentik (open-source identity provider). The issue: access tokens issued to one application can be stolen by that application and used to impersonate users against other proxy providers, and tokens legitimately issued for one app can be used to access another app the user...

PT-2024-38898 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.10.17 GitHub Enterprise Server versions prior to 3.11.15 GitHub Enterprise Server versions prior to 3.12.9 GitHub Enterprise Server versions prior to 3.13.4 GitHub Enterprise Server versions prior ...

PT-2024-30669 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.9.10 Description: The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of th...

Accessing Confluence using PAT Token fails intermittently when multiple users access concurrently

h3. Issue Summary This issue is similar to the one reported in Jira side under JRASERVER-76340|https://jira.atlassian.com/browse/JRASERVER-76340 This is reproducible on Data Center: Yes h3. Steps to Reproduce Provision a new Confluence environment Create two new users: "usera" and "userb" For eac...

GitLab: Login email verification bypass via `/oauth/token`.

Vulnerability description not provided...

Remote Command Execution Vulnerability in H2 Component of e-cology Product of Panmicro Networks Technology Co.

e-cology is a new and efficient collaborative office system created by Panavision for medium and large organizations. A remote command execution vulnerability exists in the H2 component of the e-cology product of Panmicro Networks Technology Co. The vulnerability allows obtaining an administrator...

CVE-2024-6337

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

CVE-2024-31842

Italtel Embrace 1.6.4 is affected by a vulnerability where the web application inserts an authenticated user’s access token into GET requests. The token appears in the URL’s query string and can be stored in browser history, Referer headers, web logs, or other sources, enabling attackers to use t...

Italtel Embrace 安全漏洞

Italtel Embrace is a software-only, cloud-enabled Web application server from Italtel. It can be used to enable WebRTC services in a TLC network or as a standalone WebRTC service. A security vulnerability exists in Italtel Embrace version 1.6.4, which originates when the web application inserts a...

The vulnerability of the Single Sign-On (SSO) function of the SAP BusinessObjects Business Intelligence platform allows a hacker to gain full access to the device.

The vulnerability of the Single Sign-On SSO function of the SAP BusinessObjects Business Intelligence platform is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the device by obtaining an...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from the possibility th...

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise allows a malicious actor to obtain confidential calendar information using an access token with an expired validity period.

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain confidential calendar information using ...

The vulnerability of the Access Token Handler component of the JetBrains YouTrack software suite for managing projects and tasks allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Access Token Handler component of the JetBrains YouTrack software for managing projects and tasks is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...