375 matches found
CVE-2018-17450: Server-Side Request Forgery (SSRF)
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery SSRF via the Kubernetes integration, leading for example to disclosure of a GCP service token...
SUSE CVE-2018-17450
An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is Server-Side Request Forgery SSRF via the Kubernetes integration, leading for example to disclosure of a GCP service token...
CVE-2022-3994 Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token Disclosure
The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the functionality in certain configurations...
Jenkins Gitea Plugin 安全漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
CVE-2022-3694 Syncee - Global Dropshipping < 1.0.10 - Authentication Token Disclosure
The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account...
CVE-2022-45183
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...
GHSA-8WJ3-CPMR-8WHP Cockpit Content Platform vulnerable to 2FA bypass
Cockpit Content Platform through version 2.2.1 is vulnerable to a two-factor authentication 2FA bypass. The 2FA secret is disclosed in a JWT token after user logs into their account, allowing an attacker to bypass the 2FA code. A patch is available on the develop branch and is expected to be part...
NestJS Proxy 信息泄露漏洞
NestJS Proxy is a Finastra open source NestJS module for decorating and proxying calls. A security vulnerability exists in NestJS Proxy versions prior to 0.7.0 that stems from the nestjs-proxy library's inability to control when an authorization header should be forwarded for a specific backend...
Jupyter Server 安全漏洞
Jupyter Server is a Jupyter community application used to provide back-end services for Jupyter web applications. A security vulnerability exists in Jupyter Server versions prior to 1.17.1. An attacker could exploit this vulnerability to disclose access tokens to a malicious third party and modif...
CVE-2022-24849
DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two "RequireDisCatSharpDeveloperAttribute"s or the "BaseDiscordClient.LibraryDeveloperTeam" have potentially had their bot token sent...
PT-2022-13379
Name of the Vulnerable Software and Affected Versions Booking Package WordPress plugin versions prior to 1.5.29 Description The issue allows unauthenticated users to obtain sensitive data due to the disclosure of a token used for exporting the ical representation of the booking calendar. This tok...
CVE-2022-22691 Umbraco Password Reset URL Poison
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset...
CVE-2022-22691
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset...
CVE-2022-22691: Weak Password Recovery Mechanism for Forgotten Password
The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be possible to manipulate the URL sent to Umbraco users when so that it points to the attackers server thereby disclosing the password reset...
CVE-2021-39126
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify various resources via a Cross-Site Request Forgery CSRF vulnerability, following an Information Disclosure vulnerability in the referrer headers which discloses a user's CSRF token. The affected versions a...
Siemens Teamcenter Active Workspace 信息泄露漏洞
Siemens Teamcenter Active Workspace is a software application from Siemens Germany. A product lifecycle management software. An information disclosure vulnerability exists in Teamcenter Active Workspace, where an attacker could disclose an application token because the system does not properly...
PT-2021-18659
Name of the Vulnerable Software and Affected Versions CERN Indico versions prior to 2.3.4 Description The issue arises from Indico's URL generation logic, which can be exploited by an attacker to send a password reset link with a valid token to an attacker-controlled domain. This is achieved by...
CVE-2020-2022
CVE-2020-2022 affects Palo Alto Networks Panorama/PAN-OS: an information-exposure flaw disclosing the web UI session token to a managed device when the administrator context-switches into that device. The underlying issue can allow an attacker to gain privileged access to the Panorama web interfa...
PAN-OS: Panorama session disclosure during context switch into managed device
An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacke...
