942 matches found
Sensitive Information Exposure
docusaurus-plugin-content-gists is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of configuration options that include GitHub Personal Access Tokens, which are inadvertently embedded into client-side JavaScript bundles during the production build,...
CVE-2025-53624
The CVE-2025-53624 entry concerns the Docusaurus plugin docusaurus-plugin-content-gists. Versions prior to 4.0.0 are vulnerable because a GitHub Personal Access Token passed via plugin configuration could be exposed in production build artifacts, embedding the token in client-side JavaScript bund...
SUSE CVE-2025-3230
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...
CVE-2025-52901
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token JWT which is used as a session identifier will get leaked to...
Sensitive Information Disclosure
github.com/filebrowser/filebrowser is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposure of sensitive data in URLs due to the use of access tokens as GET parameters, which can be logged in client- or server-side logs...
CVE-2025-53099
CVE-2025-53099 affects Sentry prior to 25.5.0. A race condition in handling of OAuth authorization codes could allow a malicious OAuth app to maintain persistence on a user’s account via timed requests/redirect flows and multiple authorization codes. The issue is mitigated by upgrading self-hoste...
CVE-2025-52901
File Browser (filebrowser) vulnerability CVE-2025-52901 allows leakage of JWT session tokens via GET parameters in URLs, enabling attackers with access to a user’s URL history/logs to gain full access to the user’s account and sensitive files. The issue affects versions prior to 2.33.9 and has be...
CVE-2025-52901 File Browser allows sensitive data to be transferred in URL
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token JWT which is used as a session identifier will get leaked to...
Insertion Of Sensitive Information Into Log Files
com.erudika, para-server is vulnerable to Insertion Of Sensitive Information Into Log Files. The vulnerability is due to logging full request URLs, including sensitive access tokens, in WARN-level logs during failed Facebook profile requests. It allows an attacker with access to the logs or log...
Mattermost has an unspecified vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that stems from improperly invalidated personal access tokens, which can be exploited by an attacker to maintain full system access...
Mattermost Server 9.11.x < 9.11.13 / 10.5.x < 10.5.4 / 10.6.x < 10.6.3 / 10.7.1 Multiple Vulnerabilities (MMSA-2025-00458, MMSA-2025-00463, MMSA-2025-00467)
The version of Mattermost Server installed on the remote host is prior to 9.11.13, 10.5.4, 10.6.3, or 10.7.0. It is, therefore, affected by multiple vulnerabilities as referenced in the MMSA-2025-00458, MMSA-2025-00463, MMSA-2025-00467 advisories. - Mattermost versions 10.7.x = 10.7.0, 10.6.x =...
para 日志信息泄露漏洞
para is a multi-tenant backend server open-sourced by Erudika for rapidly building web and mobile applications. A log information disclosure vulnerability exists in versions prior to para 1.50.8, which stems from explicit logging of access tokens in the logs, which could lead to token disclosure...
GO-2025-3731 Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server
Mattermost fails to properly invalidate personal access tokens upon user deactivation in github.com/mattermost/mattermost-server...
Incorrect Implementation of Authentication Algorithm
Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm. due to the improper invalidation of personal access tokens. An attacker can maintain access...
GHSA-MC2F-JGJ6-6CP3 Mattermost fails to properly invalidate personal access tokens upon user deactivation
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...
CVE-2025-3230
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...
CVE-2025-3230 Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...
CVE-2025-3230
CVE-2025-3230 affects Mattermost Server versions 9.11.x (<=9.11.12), 10.5.x (<=10.5.3), 10.6.x (<=10.6.2), and 10.7.x (
CVE-2025-3230 Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...
CVE-2025-3230 Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server
Mattermost versions 10.7.x = 10.7.0, 10.6.x = 10.6.2, 10.5.x = 10.5.3, 9.11.x = 9.11.12 fails to properly invalidate personal access tokens upon user deactivation, allowing deactivated users to maintain full system access by exploiting access token validation flaws via continued usage of previous...