776 matches found
Nuxt DevTools 安全漏洞
Nuxt DevTools is an open source set of visualization tools from Nuxt. A security vulnerability exists in Nuxt DevTools version 2.6.4 that stems from the possibility of extracting Nuxt authentication tokens via cross-site scripting under certain configurations...
PT-2025-45398
Name of the Vulnerable Software and Affected Versions Nuxt DevTools versions prior to 2.6.4 Description A flaw exists in Nuxt DevTools that could allow the extraction of Nuxt authentication tokens through a cross-site scripting XSS attack, under specific configurations. Recommendations Update to...
CVE-2025-12779
Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract...
CVE-2024-13999
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...
CVE-2025-62712
JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint...
CVE-2024-13999
Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory AD or LDAP authentication token to an authenticated user. Exposure of the server’s AD/LDAP token could allow domain-wide authentication misuse, escalation of privileges, or further compromi...
EUVD-2025-37015
Senza: Keto & Fasting Android App version 2.10.15 package name com.gl.senza, developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful...
CVE-2025-61117
Senza: Keto & Fasting Android App version 2.10.15 package name com.gl.senza, developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful...
Nagios XI 安全漏洞
Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.3 that stems from the disclosure of...
CVE-2025-54808
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...
CVE-2025-54808 Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...
CVE-2025-54808 Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the audit logging process. An attacker can obtain sensitive information by accessing improperly redacted HTTP request bodies recorded in audit logs. This may expose short-lived...
CVE-2025-62774
The CVE affects Mercku M6a devices up to version 2.1.0, where the authentication system uses session tokens that are predictable because they are based on timestamps. This introduces a potential for token guessing and authentication bypass, as described across multiple sources (Red Hat, NVD, CNNV...
PT-2025-41809
Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.2.27 Mastodon versions prior to 4.3.14 Mastodon versions prior to 4.4.6 Description Mastodon is a free, open-source social network server based on ActivityPub. The streaming server incorrectly handles authenticatio...
CVE-2025-11645 Tomofun Furbo Mobile App Authentication Token sensitive information
A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication Token Handler. The manipulation leads to insecure storage of sensitive information. It is possible to launch the attack on the physical...
CVE-2025-11645
CVE-2025-11645 (Tomofun Furbo Mobile App) affects Android versions up to 7.57.0a, arising from insecure storage in the Authentication Token Handler. The issue may allow information disclosure on a physical device; the exploit has been publicly disclosed. Multiple connected sources (including PT-2...
EUVD-2014-8851
Malware in sbrugna...