Information disclosure

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

Design/Logic Flaw

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32217

Summary: CVE-2022-32217 affects Rocket.Chat prior to v4.6.4, where an OAuth token is leaked in plaintext in logs, leading to potential information disclosure. What’s affected: Rocket.Chat versions before 4.6.4; the issue is a cleartext storage/disclosure of sensitive OAuth tokens in logs. Root ca...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32227

CVE-2022-32227 affects Rocket.Chat prior to v5, v4.8.2, and v4.7.5, where a user with the permission view-full-other-user-info could access another user’s OAuth tokens via the REST API (users.info). The root cause is cleartext transmission/leak of sensitive OAuth token data. Impact described incl...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. This is a post from HackRead.com Read the...

Hackers Using Fake CircleCI Notifications to Hack GitHub Accounts

GitHub has put out an advisory detailing what may be an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication 2FA codes by impersonating the CircleCI DevOps platform. The Microsoft-owned code hosting service said it learned of the attack on September 16,...

CVE-2022-39230

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s...

Authorization

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s...

CVE-2022-39230 Security issue in fhir-works-on-aws-authz-smart

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s...

CVE-2022-39230

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s...

CVE-2022-39230 Security issue in fhir-works-on-aws-authz-smart

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposure of Sensitive Information to an Unauthorized Actor. This issue allows a client of the API to retrieve more information than the client’s...

Hackers Using Malicious OAuth Apps to Take Over Email Servers

Microsoft on Thursday warned of a consumer-facing attack that made use of rogue OAuth applications deployed on compromised cloud tenants to ultimately seize control of Exchange servers and spread spam. "The threat actor launched credential stuffing attacks against high-risk accounts that didn't...