98 matches found
New Ongoing Campaign Targets npm Ecosystem with Unique Execution Chain
Cybersecurity researchers have discovered a new ongoing campaign aimed at the npm ecosystem that leverages a unique execution chain to deliver an unknown payload to targeted systems. "The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources...
CVE-2022-45183
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app tokens by ID via an HTTP web request. Patched Versions are 3.5.3, 3.4.7, and 2.12.6...
CVE-2022-30628
It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKEN. Then you can then access the API that provides invoice images based on the URL...
SaltStack Salt Authentication Bypass Vulnerability
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master and/...
Denial Of Service (DoS)
cxf-rt-rs-security-oauth2 is vulnerable to denial of service DoS. The vulnerability exists as it does not properly validate the requesturi parameter, allowing a REST request to the parameter in the request to retrieve a token...
Spadeico Digital Error Vulnerability
Spadeico is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mint' function in Spadeico. An attacker can exploit the vulnerability to retrieve generated tokens...
VulnCheck KEV: CVE-2020-11651
SaltStack Salt contains an authentication bypass vulnerability in the salt-master process ClearFuncs due to improperly validating method calls. The vulnerability allows a remote user to access some methods without authentication, which can be used to retrieve user tokens from the salt master...
Shopify: Get analytics token using only apps permission
It seems apps that can read "analytics" have embedded analytic token. In order to access the /admin/reportify/token.json endpoint explicit dashboard or reports permission is required. A staff member with just "apps" permission can leverage the permissions of apps that can read reports to extract...
GVToken Genesis Vision Security Vulnerability
GVToken Genesis Vision GVT is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mint' function in GVT. An attacker can exploit the vulnerability to retrieve generated tokens...
Bitotal Number Error Vulnerability
Bitotal TFUND is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in TFUND. An attacker can exploit the vulnerability to retrieve generated tokens...
MoxyOnePresale Digital Error Vulnerability
MoxyOnePresale is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in MoxyOnePresale. An attacker could use this vulnerability to retrieve generated tokens...
SpadePreSale Digital Error Vulnerability
SpadePreSale is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in SpadePreSale. An attacker could use this vulnerability to retrieve generated tokens...
[SECURITY] [DSA 4676-1] salt security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4676-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 06, 2020 https://www.debian.org/security/faq -...
Exploit for CVE-2020-11651
CVE-2020-11651 An issue was discovered in SaltStack Salt befo...
PYSEC-2020-102
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...
CVE-2020-1772
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...
CVE-2020-1772
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...
CVE-2020-1772 Information Disclosure
It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...
Cross-Site Scripting (XSS)
web-console is vulnerable to cross-site scripting. The vulnerability, caused by missing X-Frame-Options and CSRF protections, in the oauth/token/request endpoint could allow a remote attacker to retrieve a token for CLI usage when using non default configs...
