PT-2024-31386 · Tophat · Tophat

Name of the Vulnerable Software and Affected Versions: Tophat versions prior to 1.10.0 Description: The issue is related to an Improper Access Control vulnerability that can expose the TOPHAT APP TOKEN token stored in /.tophatrc through the use of a malicious Tophat URL controlled by the attacker...

PT-2024-10235 · Versa · Versa Director

Name of the Vulnerable Software and Affected Versions: Versa Director affected versions not specified Description: The issue is related to the REST API in Versa Director, which is used for orchestration and management. Certain APIs, such as the login screen, banner display, and device registratio...

CVE-2024-42531

creationtimestamp| type| source ---|---|--- 2024-08-23 19:38:45+00:00| seen| https://t.me/cvedetector/4023 2024-08-29 09:08:07+00:00| published-proof-of-concept| https://t.me/HackingInsights/11495...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

CVE-2024-32931

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

CVE-2024-32931 exacqVison - Token Disclosed in URL

Under certain circumstances the exacqVision Web Service can expose authentication token details within communications...

CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...

CVE-2024-39879

In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings...

CVE-2024-39879

In JetBrains TeamCity before 2024.03.3 application token could be exposed in EC2 Cloud Profile settings...

Canonical Ubuntu Advantage Desktop Daemon Security Vulnerability

Canonical Ubuntu Advantage Desktop Daemon is a daemon from Canonical UK that allows desktop applications to interact with Ubuntu Advantage. A security vulnerability exists in Canonical Ubuntu Advantage Desktop Daemon versions prior to 1.12, which originated from passing the Pro token as a paramet...

axios: exposure of confidential data stored in cookies

A flaw was found in Axios that may expose a confidential session token. This issue can allow a remote attacker to bypass security measures and view sensitive data...

PT-2024-25676 · Strapi · @Strapi/Plugin-Users-Permissions

Name of the Vulnerable Software and Affected Versions: @strapi/plugin-users-permissions versions prior to 4.24.2 Description: The issue arises from combining two vulnerabilities in @strapi/plugin-users-permissions: an Open Redirect and a session token sent as a URL query parameter. This allows an...

CVE-2024-37051

CVE-2024-37051 describes insufficient protection of GitHub access tokens in multiple JetBrains IDEs, allowing potential exposure of tokens to third-party sites. Affected products/versions include IntelliJ IDEA, Aqua, CLion, DataGrip, DataSpell, GoLand, MPS, PhpStorm, PyCharm, Rider, RubyMine, Rus...

CVE-2024-37051

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5,...

PT-2024-34599 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.2.4 Description: An account takeover issue exists due to the exposure of password recovery tokens in API responses. When a user initiates the password reset process, the recovery token is included in the response of...

GHSA-3F65-M234-9MXR github.com/huandu/facebook may expose access_token in error message.

Summary accesstoken can be exposed in error message on fail in HTTP request. Details Using this module, when HTTP request fails, error message can contain accesstoken. This can be happen when: - module is sending HTTP request with query parameter ?accesstoken=.... - and HTTP request fails errors...

Facebook Graph API SDK 安全漏洞

Facebook Graph API SDK is a Go package from the individual developer Huan Du in China. A security vulnerability exists in Facebook Graph API SDK versions prior to 2.7.2, which stems from the fact that accesstoken may be disclosed in an error message when an HTTP request fails...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

Dapr 信息泄露漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. A security vulnerability exists in Dapr that stems from the disclosure of application tokens when using Dapr as a gRPC proxy for remote service calls. Affected products and versions:Dapr version 1.13.0, 1.13.1, 1.13.2...

CVE-2024-34706

Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...