CVE-2024-2355

CVE-2024-2355 affects keerti1924 Secret-Coder-PHP-Project 1.0. The vulnerability involves an issue in an unknown functionality of the file /secret_coder.sql, where manipulation leads to inclusion of sensitive information in source code. Reported as exploitable remotely with rather high attack com...

Secret-Coder-PHP-Project Security Vulnerability

Secret-Coder-PHP-Project is a PHP-based project. A security vulnerability exists in version 1.0 of Secret-Coder-PHP-Project that stems from the inclusion of sensitive information in the code...

PT-2024-19932 · Unknown · Keerti1924 Secret-Coder-Php-Project

Name of the Vulnerable Software and Affected Versions: keerti1924 Secret-Coder-PHP-Project version 1.0 Description: A vulnerability has been found in the keerti1924 Secret-Coder-PHP-Project, affecting an unknown functionality of the file /secret coder.sql. The manipulation leads to the inclusion ...

MAL-2024-1062 Malicious code in unity-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d7a62539b563d36148b212913759293a68090ffa3505239a01cd432698619c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-2266

A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attac...

CVE-2024-2266

A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attac...

CVE-2024-2266 keerti1924 Secret-Coder-PHP-Project Login Page login.php cross site scripting

A vulnerability has been found in keerti1924 Secret-Coder-PHP-Project 1.0 and classified as problematic. This vulnerability affects unknown code of the file /login.php of the component Login Page. The manipulation of the argument emailcookie/passwordcookie leads to cross site scripting. The attac...

CVE-2024-2266

CVE-2024-2266 affects keerti1924 Secret-Coder-PHP-Project 1.0, specifically the Login Page file /login.php. The vulnerability is caused by improper handling of the parameters emailcookie and passwordcookie, enabling remote cross-site scripting (XSS) . Exploitation is possible remotely and the exp...

PT-2024-19523 · Unknown · Keerti1924 Secret-Coder-Php-Project

Name of the Vulnerable Software and Affected Versions: keerti1924 Secret-Coder-PHP-Project version 1.0 Description: A vulnerability has been found in the Login Page component, specifically in the file /login.php. The manipulation of the emailcookie and passwordcookie arguments leads to cross-site...

Secret-Coder-PHP-Project Cross-Site Scripting Vulnerability

Secret-Coder-PHP-Project is a PHP-based project. keerti1924 A cross-site scripting vulnerability exists in version 1.0 of Secret-Coder-PHP-Project, which stems from a cross-site scripting XSS vulnerability in the parameters emailcookie/passwordcookie in the file /login.php of the component Login...

BIT-GITLAB-2020-13304

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain access under certain conditions...

BIT-GITLAB-2022-3902

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to unmask webhook secret tokens by reviewing the logs after testing...

BIT-GITLAB-2022-4054

An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an...

BIT-VAULT-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases specifically, those within 1 second of their maximum TTL, which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2...

BIT-VAULT-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a...

BIT-REDASH-2021-43780

Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advanced methods of Server Side Request Forgery SSRF. These vulnerabilities are only exploitable on installations where a...

BIT-GRAFANA-2020-12459

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml which contain a secretkey and a bindpassword are world readable...

BIT-NGINX-INGRESS-CONTROLLER-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...

BIT-AIRFLOW-2023-40712 Apache Airflow: Secrets can be unmasked in the "Rendered Template"

Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly...

BIT-EJBCA-2021-40086

An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page that can only be viewed by an administrator. While hidden from direct view, checking the page source would...