Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

CVE-2026-46481: Insertion of Sensitive Information Into Sent Data

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TESTCONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in...

CVE-2024-39896

Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs t...

EUVD-2017-1416

Malware in sbrugna...

com.bluefirereader:sso-user (>=1.0.0, <=1.2.13), com.intropro:b-test (>=1.0.2, <=1.0.10) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.26)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.26 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.bluefirereader:sso-user =1.0.0, =1.0.2, =1.0.10 - com.nimbusds:oauth2-oidc-sdk 3.3 -...

PT-2021-6695 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 Description: The issue is related to improper authorization in GitLab, allowing a remote attacker to impact data integrity. It is also described as an improper access control issue, enabling use...