EUVD-2020-3139

Malware in sbrugna...

EUVD-2018-15567

Malware in sbrugna...

EUVD-2024-34309

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-31690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certai...

CVE-2023-45151

Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and users are recommended to upgrade their...

Malicious code in customer-oauth2-token-management-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7470945b8ee8dd4e437867aa2317e357a5536870671edc131c9c21ee62111acc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7944 Malicious code in customer-oauth2-token-management-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7470945b8ee8dd4e437867aa2317e357a5536870671edc131c9c21ee62111acc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Basecamp: Account takeover via insecure intent handling

The Basecamp app was vulnerable to account takeover due to insecure intent handling. A malicious app installed on the same device could obtain the user's Oauth2 token and take over their account...

Delinea PAM Secret Server User Enumeration Vulnerability

Delinea PAM Secret Server is a key service manager from Delinea. A user enumeration vulnerability exists in Delinea PAM Secret Server version 11.4, which stems from a significant difference between valid and invalid login attempts, and can be exploited by a remote attacker to determine whether a...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

CVE-2024-25651

User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. This allows a remote attacker to determine whether a user is valid because of a difference in responses from the /oauth2/token endpoint...

ROS-20231024-03

The OAuth2 token vulnerability of the cloud-based software for creating and utilizing Nextcloud storage Nextcloud data storage software is related to the storage of OAuth2 tokens in plaintext. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to the server a...

Mattermost Code Issue Vulnerability (CNVD-2023-55039)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost has a code issue vulnerability that can be exploited by an attacker with administrator privileges to maintain privileges by obtaining an oauth2 access token...

CVE-2021-32753

EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is...

CVE-2021-32753 Weak password in API gateway in EdgeX Foundry Edinburgh, Fuji, Geneva, and Hanoi releases allows remote attackers to obtain authentication token via dictionary-based password attack when OAuth2 authentication method is enabled.

EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is...

CVE-2020-10709

A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to...

PT-2021-9170 · Red Hat · Ansible Tower

Name of the Vulnerable Software and Affected Versions: Ansible Tower versions prior to 3.6.4 Ansible Tower versions prior to 3.5.6 Description: A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide...