PT-2024-35447 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions prior to v1.49.0 Description: The issue is related to the rate limiter in Password Pusher, which can be bypassed by forging proxy headers, allowing bad actors to send unlimited traffic to the site and potentially...

PT-2024-41025

Name of the Vulnerable Software and Affected Versions Password Pusher affected versions not specified Description The issue is related to incorrect session management in the Password Pusher web service, which allows for the transmission of information via temporary links. This can be exploited by...

PT-2024-37046 · Unknown · Password Pusher

Name of the Vulnerable Software and Affected Versions: Password Pusher versions 1.50.3 and prior Description: A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session tok...

Authentication Bypass

pusher/pusher-php-server is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of the channel name and socket ID, which allows malicious end-users to forge access to unauthorized private channels...

GHSA-7V7M-PCW5-H3CG Pusher Service Channel Authentication Bypass

The service offered by Pusher provides "private" channels with an authentication mechanism that restricts subscription access. The decision on allowing subscriptions to private channels is delegated to customers, who implement an authentication endpoint. End-users request a token from this endpoi...

Pusher Service Channel Authentication Bypass

The service offered by Pusher provides "private" channels with an authentication mechanism that restricts subscription access. The decision on allowing subscriptions to private channels is delegated to customers, who implement an authentication endpoint. End-users request a token from this endpoi...

PT-2024-40170

Name of the Vulnerable Software and Affected Versions: Pusher affected versions not specified Description: The issue arises from a lack of validation in the libraries provided to customers, allowing a malicious end-user to submit a malformed socket id field. This leads the customer to unknowingly...

pencil-pusher (1.6.0), straitjacket (202104.1018.0) potentially affected by CVE-2024-21503 via black (21.4.0b2)

black PYPI version 21.4.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - pencil-pusher 1.6.0 - straitjacket 202104.1018.0 Source cves: CVE-2024-21503 Source advisory: OSV:GHSA-FJ7X-Q9J7-G6Q6...

pencil-pusher (1.6.1) potentially affected by CVE-2024-21503 via black (21.5.0b0)

black PYPI version 21.5.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - pencil-pusher 1.6.1 Source cves: CVE-2024-21503 Source advisory: OSV:GHSA-FJ7X-Q9J7-G6Q6...

pencil-pusher (1.6.1) potentially affected by CVE-2024-21503 via black (21.5.0b0)

black PYPI version 21.5.0b0 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - pencil-pusher 1.6.1 Source cves: CVE-2024-21503 Source advisory: OSV:PYSEC-2024-48...

Tokens stored in plain text by Dingding JSON Pusher Plugin

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

GHSA-WJR6-V4C7-8CV6 Tokens stored in plain text by Dingding JSON Pusher Plugin

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2023-50772

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2023-50773

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2023-50772

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

CVE-2023-50773

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

Design/Logic Flaw

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2023-50773

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2023-50773

Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them...