CVE-2023-1584

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

Authorization

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

CVE-2023-1584 Quarkus-oidc: id and access tokens leak via the authorization code flow

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provide...

Dependabot impersonators cause trouble on GitHub

GitHub is experiencing issues of the "breached account and malicious code" variety. ITPro reports that unnamed individuals have been compromising accounts and using them to install malware capable of password theft. Its a fairly elaborate scam which even includes imitation of GitHubs popular...

The vulnerability of the Docker Desktop platform for developing and delivering container applications relates to the exposure of protected information, which allows a malicious actor to obtain access tokens.

The vulnerability of the Docker Desktop platform for developing and delivering container applications is related to the exposure of protected information. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain access tokens through a specially created URL addre...

CVE-2023-39046

An information leak in TonTon-Teiwaiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

CVE-2023-39056

An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages...

Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit c9aa2eeb9 access tokens which fail validation are rejected...

GHSA-J2GJ-G3P9-7MRR Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit c9aa2eeb9 access tokens which fail validation are rejected...

CVE-2023-39438

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

Authorization

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

CVE-2023-39438 Missing Authorization check allows certain operations on CLA Assistant data

A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including information of the persons who signed them as...

Mobileiron Sentry Authorization Issue Vulnerability

Mobileiron Sentry is a Smart Gateway product from Mobileiron, Inc. An authorization issue vulnerability exists in Sentry versions 10.0.0 through prior to 23.7.2 that originates from a vulnerability that allows an attacker to retrieve valid access tokens from other users during an OAuth token...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to obtain the names of project access tokens, which could then be used to access and modify GitLab projects...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because of not managing the sessions properly which allows an attacker with expired password to still access GitLab through git and API through access tokens acquired before password expiration...

CVE-2023-3993

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint...

CVE-2023-3993 Insertion of Sensitive Information into Log File in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a specific endpoint...