CVE-2023-50294

The App Settings /admin/app page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page...

CVE-2023-50294

The App Settings /admin/app page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page...

Malicious code in discord.js-self-v21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7ff51b0a254299fbcba44e692ad912d759a48d835ffcb10759424392b1debdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in myservice.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5e7166b9d2dc785b619a4e36f5aeb34e44716a8d8c0fc3b31771358e77d7399 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in run-matlab-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e112d304d52f86f1e23bf9c1b924fa1b169382680990b66bc9268c01fc426aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authentication Bypass

github.com/navidrome/navidrome is vulnerable to Authentication bypass. The vulnerability is due to the DefaultGet function within auth.go which is used to retrieve the JWT secret key from the database. If the key is not found or an error occurs during retrieval, it defaults to using the hardcoded...

CVE-2023-27172

Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack...

CVE-2023-27172

Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to sign JWT tokens via a bruteforce attack...

Hackers Abusing GitHub to Evade Detection and Control Compromised Hosts

Threat actors are increasingly making use of GitHub for malicious purposes through novel methods, including abusing secret Gists and issuing malicious commands via git commit messages. "Malware authors occasionally place their samples in services like Dropbox, Google Drive, OneDrive, and Discord ...

Malicious code in hpulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8e05ef1449de96d2983cf58d8db74565a1a331c63044ce1c166505af88b7409 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crossdomain-xhr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ab343d1f78365f0bc2589bd835b94aa0fd90723d8e80a9d0b774a3a99589b0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-20989 · Xpand It · Xpand It Write-Back Manager

Name of the Vulnerable Software and Affected Versions: Xpand IT Write-back Manager version 2.3.1 Description: The issue is related to the use of weak secret keys to sign JWT tokens, allowing attackers to obtain the secret key via a bruteforce attack. Recommendations: For Xpand IT Write-back Manag...

Liberapay: Avatar URL is exposed in patron export for secret donations

The avatar URL was exposed in the patron export for secret donations, which could potentially identify donors who wished to remain anonymous...

CVE-2023-1904

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...

CVE-2023-1904

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...

MAL-2023-8698 Malicious code in css-hell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware add41af1a627bb97a8a95ccab38f262f0d07cd937276bb7b10b01d01f4a4478d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-17328 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows the OpenID client secret to be logged in clear text during the configuration of the server. Recommendations: At the moment, there is no information about a newer...

CVE-2023-48225 Laf env causes sensitive information disclosure

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

PT-2023-30742 · Laf · Laf

Name of the Vulnerable Software and Affected Versions: Laf versions prior to 1.0.0-beta.13 Description: Laf is a cloud development platform where the control of LAF app environment variables is not strict enough, potentially leading to sensitive information leakage in secret and configmap. This...

secret-character.com Improper Access Control vulnerability OBB-3810414

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...