460 matches found
CVE-2024-7569
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information...
CVE-2024-7569
CVE-2024-7569 : Ivanti ITSM on-prem and Neurons for ITSM (versions 2023.4 and earlier) contain an information-disclosure flaw that allows an unauthenticated attacker to retrieve the OIDC client secret via debug information. Public sources consistently describe impact as high confidentiality risk ...
CVE-2024-7569
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information...
Eclipse Dataspace Components vulnerable to OAuth2 client secret disclosure
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component, an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, we have identified a security vulnerability in the EDC Connector component...
PT-2024-31579 · Eclipse · Eclipse Dataspace Components
Name of the Vulnerable Software and Affected Versions: Eclipse Dataspace Components versions 0.2.1 through 0.6.2 Description: A security issue has been identified in the EDC Connector component of Eclipse Dataspace Components, related to the OAuth2-protected data sink feature. When using a custom...
CVE-2024-4369
An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURECLIENTSECRET can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions t...
CVE-2024-4369 Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure
An information disclosure flaw was found in OpenShift's internal image registry operator. The AZURECLIENTSECRET can be exposed through an environment variable defined in the pod definition, but is limited to Azure environments. An attacker controlling an account that has high enough permissions t...
CVE-2023-40545
Authentication bypass when an OAuth2 Client is using clientsecretjwt as its authentication method on affected 11.3 versions via specially crafted requests...
PT-2024-12897 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX version 11.3 Description: The issue is related to authentication bypass when an OAuth2 Client uses client secret jwt as its authentication method. This can be exploited via specially crafted requests. Recommendations: For version...
Line Security Breach
Line is an instant messaging platform from Line Inc. A security vulnerability exists in Line version v.13.6.1, which originates from disclosing key credentials client secret to the client, allowing remote attackers to obtain the key...
CVE-2023-1904
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...
PT-2023-17328 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows the OpenID client secret to be logged in clear text during the configuration of the server. Recommendations: At the moment, there is no information about a newer...
CVE-2023-39735
The leakage of the client secret in UomasaSaijinews Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...
CVE-2023-39739
The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...
CVE-2023-39739
The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...
CVE-2023-39732
The leakage of the client secret in Tokueimaruwaiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...
CVE-2023-39740
The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...
CVE-2023-39732
The leakage of the client secret in Tokueimaruwaiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...