CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

Design/Logic Flaw

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

MAL-2023-8389 Malicious code in @rappiinc/partner-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1077f54b61ad7f744086cdd8c1d66f8d3d7dd074ed0a585b608b4734d3a6f25e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-34441

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-34441

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

Design/Logic Flaw

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PT-2023-27088 · Unknown · Kaibutsunosato

Name of the Vulnerable Software and Affected Versions: Kaibutsunosato version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Kaibutsunosato version 13.6.1, update to a version that...

CVE-2023-39731

The CVE-2023-39731 entry concerns Kaibutsunosato v13.6.1, where leakage of the client secret enables attackers to obtain the channel access token and issue crafted broadcast messages. Public sources in the connected documents consistently describe an information-disclosure flaw in the client that...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

HackerOne: New Search Feature: Search for non-public words in limited disclosure reports

A vulnerability was discovered that allowed an attacker to search for words in limited disclosure vulnerability reports on HackerOne and see if the word existed in the full report, rather than just the limited disclosure portion. This could potentially allow secrets contained within a full report...

Timing Attack

Harbor is vulnerable to timing attacks. The vulnerability is due the comparison of secrets which are not run in constant time. This allows an attacker to decipher response times for cryptographic calculation and secret enumeration, which can result in sensitive information disclosure...

OAuth2 client_secret stored in plain text in the database

None...

MAL-2023-8386 Malicious code in very-bad-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b6aab39bd84cb65205f0339a8531e90906143bc204d65dab3f378e8ef83619d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Apache Superset 2.0.0 Remote Code Execution Exploit

Apache Superset versions 2.0.0 and below utilize Flask with a known default secret key which is used to sign HTTP cookies. These cookies can therefore be forged. If a user is able to login to the site, they can decode the cookie, set their userid to that of an administrator, and re-sign the cooki...

MAL-2023-8376 Malicious code in @momo-miniapp/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6007d4e44cc4c068a9bb068cda01c272f184a9023da891b3f63737a50f814575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...