267 matches found
CVE-2022-1162
CVE-2022-1162 A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts. Exploit: New Gitlab Accounts...
GitLab CE/EE - Hard-Coded Credentials
GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...
MAL-2026-14526 Malicious code in omniauth-recharge-rails-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7 The package's package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL...
Malicious code in omniauth-recharge-rails-example (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7 The package's package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL...
Malicious Package
Overview omniauth-recharge-rails-example is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insecure default behavior in the idpcertfingerprintvalidator. An attacker can bypass certificate validation by providing any certificate fingerprint, which will be accepted as valid. Remediation...
CVE-2026-44707: Unverified Ownership
Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover Pre-ATO vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not...
WS-2019-0200
omniauth-amazon 1.0.1 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...
EUVD-2020-5574
Malware in sbrugna...
EUVD-2020-1445
Malware in sbrugna...
EUVD-2017-0216
Malware in sbrugna...
EUVD-2019-0585
Malware in sbrugna...
EUVD-2020-1480
Malware in sbrugna...
EUVD-2017-0228
Malware in sbrugna...
EUVD-2017-8873
Malware in sbrugna...
EUVD-2018-0158
Malware in sbrugna...
EUVD-2024-0260
Malicious code in bioql PyPI...
EUVD-2024-16978
Malicious code in bioql PyPI...