CVE-2024-12056 Client Secret not checked with OAuth Password grant type

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit...

PcVue 安全漏洞

PcVue is a reliable, secure, and powerful operational software platform from PcVue, Inc. dedicated to monitoring and controlling applications in markets such as building and campus management. A security vulnerability exists in PcVue versions 12.0 through 16.2.0 that stems from the use of the OAu...

GHSA-V5H2-Q2W4-GPCX Sentry improper error handling leaks Application Integration Client Secret

Impact During routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the...

Sentry improper error handling leaks Application Integration Client Secret

Impact During routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-53253

CVE-2024-53253 affects Sentry v24.11.0 (self-hosted); a specific error message could leak plaintext integration Client ID and Client Secret in an HTTP response when a failing third‑party response triggers select-requester.invalid-response during a Search UI async flow. The leak does not grant dat...

CVE-2024-53253 Sentry's improper error handling leaks Application Integration Client Secret

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

PT-2024-35692 · Sentry · Sentry

Name of the Vulnerable Software and Affected Versions: Sentry version 24.11.0 Description: Sentry is an error tracking and performance monitoring platform. A specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integratio...

CVE-2024-11217 Oauth-server-container: oauth-server-container logs client secret in debug level

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2024-11217 Oauth-server-container: oauth-server-container logs client secret in debug level

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

CVE-2024-11217

CVE-2024-11217 affects the OAuth-server (including oauth-server-container). The vulnerability causes the OAuth2 client secret to be logged when the logLevel is set to Debug or higher for OIDC/GitHub/GitLab/Google IDP logins. Impact is exposure of OAuth2 client secrets via logs (confidentiality ri...

PT-2024-16834

Name of the Vulnerable Software and Affected Versions OAuth-server affected versions not specified Description A weakness was found in the OAuth-server, where it logs the OAuth2 client secret when the logLevel is set to Debug or higher for certain login options, including OIDC, GitHub, GitLab, an...

CVE-2024-11217

A vulnerability was found in the OAuth-server. OAuth-server logs the OAuth2 client secret when the logLevel is Debug higher for OIDC/GitHub/GitLab/Google IDPs login options...

GHSA-3PG4-QWC8-426R OpenRefine leaks Google API credentials in releases

Impact OpenRefine releases contain Google API authentication keys "client id" and "client secret" which can be extracted from released artifacts. For instance, download the package for OpenRefine 3.8.2 on linux. It contains the file...

CVE-2024-45160

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty clientpassword parameter client secret...

VulnCheck KEV: CVE-2024-9014

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...

Exploit for CVE-2024-9014

This post is a research article published by EQSTLabhttps://g...

CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data...

CVE-2024-7569

An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information...