PT-2024-31608 · Opencti · Opencti

Name of the Vulnerable Software and Affected Versions: OpenCTI versions prior to 6.2.18 Description: The issue affects the two-factor authentication mechanism in OpenCTI, an open-source cyber threat intelligence platform. Due to the lack of a function to limit the rate of One Time Passwords OTPs,...

Microsoft Bookings Flaw Enables Account Hijacking and Impersonation

A vulnerability in Microsoft Bookings can expose your organization to serious security risks. Learn how attackers can exploit…...

CVE-2024-51382

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the syste...

SOPlanning 1.52.00 Cross Site Request Forgery Vulnerability

/...

Information Leakage

scrapy is vulnerable to Information Leakage. The vulnerability is due to the failure to remove the Authorization header when redirecting across domains, resulting in the exposure of sensitive credentials to unauthorized actors which could potentially lead to account hijacking...

GHSA-4Q82-J5C2-G2C5 Duplicate Advisory: Scrapy authorization header leakage on cross-domain redirect

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw9j-q3vf-hrrv. This link is maintained to preserve external references. Original Description In scrapy versions before 2.11.1, an issue was identified where the Authorization header, containing credentials for...

CVE-2024-3574

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

DEBIAN-CVE-2024-3574

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

UBUNTU-CVE-2024-3574

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

CVE-2024-3574

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

CVE-2024-3574

CVE-2024-3574 affects Scrapy up to version 2.10.1, where the Authorization header used for server authentication can be leaked to a third‑party site during cross‑domain redirects. The root cause is the failure to remove the Authorization header when redirecting across domains (or when redirects c...

CVE-2024-3574 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

CVE-2024-3574

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

CVE-2024-3574 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

CVE-2024-3574 Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server authentication, is leaked to a third-party site during a cross-domain redirect. This vulnerability arises from the failure to remove the Authorization header when redirecting across...

Scrapy 信息泄露漏洞

Scrapy is a free and open source web crawler framework written in Python. An information disclosure vulnerability exists in Scrapy version 2.10.1, which stems from a failure to remove the authorization header during a cross-domain redirect, exposing the authorization header to unauthorized...

Ubuntu: Security Advisory (USN-6722-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-30264

Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...

CVE-2024-30264 typebot.io: `GHSL-2024-040`

Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...

Internet Bug Bounty: CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPE

CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID2.0 is in use as AUTHTYPE. When OpenID2.0 was used as the Authentication Type, an attacker could forge authentication to any existing account in the target Airflow installation by deceiving the backend to trust arbitrary Open...