CVE-2024-47771

CVE-2024-47771 affects Element Desktop. Versions 1.11.70–1.11.80 expose access tokens under crafted conditions, with at least one vector identified (malicious widgets); other vectors may exist. Red Hat/SUSE/OpenSUSE advisories confirm the issue and recommend upgrading to Element Desktop/Web 1.11....

CVE-2024-47771 Element Desktop vulnerable to potential exposure of access token via authenticated media

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involvi...

CVE-2024-47771 Element Desktop vulnerable to potential exposure of access token via authenticated media

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involvi...

CVE-2024-47771 Element Desktop vulnerable to potential exposure of access token via authenticated media

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involvi...

Element 安全漏洞

Element is a Matrix web collaboration client from Element Open Source. A security vulnerability exists in Element that stems from a vulnerability that could lead to an access token disclosure under certain circumstances...

element-web -- Potential exposure of access token via authenticated media

Element team reports: Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors...

GO-2024-3179 Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium

Pomerium service account access token may grant unintended access to databroker API in github.com/pomerium/pomerium...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

Pomerium service account access token may grant unintended access to databroker API

Impact We've identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments. Who is affected? A Pomerium deployment is susceptible to this issue if all of the...

CVE-2024-47077

CVE-2024-47077 affects authentik (open-source identity provider). The issue: access tokens issued to one application can be stolen by that application and used to impersonate users against other proxy providers, and tokens legitimately issued for one app can be used to access another app the user...

PT-2024-38898 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.10.17 GitHub Enterprise Server versions prior to 3.11.15 GitHub Enterprise Server versions prior to 3.12.9 GitHub Enterprise Server versions prior to 3.13.4 GitHub Enterprise Server versions prior ...

PT-2024-30669 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.9.10 Description: The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of th...

Accessing Confluence using PAT Token fails intermittently when multiple users access concurrently

h3. Issue Summary This issue is similar to the one reported in Jira side under JRASERVER-76340|https://jira.atlassian.com/browse/JRASERVER-76340 This is reproducible on Data Center: Yes h3. Steps to Reproduce Provision a new Confluence environment Create two new users: "usera" and "userb" For eac...

GitLab: Login email verification bypass via `/oauth/token`.

Vulnerability description not provided...

Remote Command Execution Vulnerability in H2 Component of e-cology Product of Panmicro Networks Technology Co.

e-cology is a new and efficient collaborative office system created by Panavision for medium and large organizations. A remote command execution vulnerability exists in the H2 component of the e-cology product of Panmicro Networks Technology Co. The vulnerability allows obtaining an administrator...

CVE-2024-6337

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...