CVE-2022-21817

NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code...

CVE-2022-21817

NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code...

CVE-2022-21817

NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing CORS vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code...

Nvidia Omniverse Launcher 代码问题漏洞

Nvidia Omniverse Launcher is an easily extensible open platform from Nvidia. It is built for virtual collaboration and real-time physically accurate simulations. NVIDIA Omniverse Launcher has a security vulnerability that can be exploited by remote attackers to browse malicious websites and obtai...

PT-2022-15151 · Nvidia · Nvidia Omniverse Launcher

Name of the Vulnerable Software and Affected Versions: NVIDIA Omniverse Launcher affected versions not specified Description: The issue is related to a Cross-Origin Resource Sharing CORS vulnerability. This vulnerability can allow an unprivileged remote attacker to acquire access tokens, enabling...

Security Bulletin: NVIDIA Omniverse Launcher - January 2022

NVIDIA has released a software update for NVIDIA Omniverse Launcher to address a security issue that may lead to privilege escalation, impacting confidentiality and integrity. To protect your system, open the Omniverse Launcher client which will automatically apply the security update...

GHSA-XC47-3RCH-CV57 Improper Access Control in snipe-it

Users with no system permissions are able to see and create personal access tokens...

Improper Access Control in snipe-it

Users with no system permissions are able to see and create personal access tokens...

TokenUniverse - An Advanced Tool For Working With Access Tokens And Windows Security Policy

Token Universe is an advanced tool that provides a wide range of possibilities to research Windows security mechanisms. It has a convenient interface for creating, viewing, and modifying access tokens, managing Local Security Authority and Security Account Manager's databases. It allows you to...

PT-2022-13014 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.8 Description: The issue affects snipe-it due to a Missing Authorization vulnerability, which is also described as an Improper Access Control vulnerability. This allows users with no system permissions to see an...

Docker 日志信息泄露漏洞

Docker is an open source application container engine from the U.S. company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment and upgrade of applications through...

CVE-2021-39915

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects...

CVE-2021-39915

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects...

CVE-2021-39915

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects...

UBUNTU-CVE-2021-39915

Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects...

PT-2021-22761 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 through 14.3.6 GitLab CE/EE versions 14.4 through 14.4.4 GitLab CE/EE versions 14.5 through 14.5.2 Description: The issue is related to improper access control in the GraphQL API, allowing an attacker to see the nam...

Over a Dozen Malicious NPM Packages Caught Hijacking Discord Servers

At least 17 malware-laced packages have been discovered on the NPM package Registry, adding to a recent barrage of malicious software hosted and delivered through open-source software repositories such as PyPi and RubyGems. DevOps firm JFrog said the libraries, now taken down, were designed to gr...

Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend

Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but i...

GHSA-W7FJ-336R-VW49 Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend

Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but i...

backstage cross-site scripting vulnerability

backstage is an application. Backstage is an open platform for building developer portals Backstage is vulnerable to a cross-site scripting vulnerability that stems from the lack of filtering and escaping of URL parameters in the affected version of the auth-backend plugin. An attacker could use...