Gatling Enterprise 安全漏洞

Gatling Enterprise is a load testing and performance testing management platform from Gatling France. A security vulnerability exists in Gatling Enterprise versions prior to 1.25.0 that stems from improper session management and could result in session tokens remaining available after logout...

Himmelblau 日志信息泄露漏洞

Himmelblau is an Azure Entra ID authentication module open-sourced by Himmelblau. A log information disclosure vulnerability exists in Himmelblau versions prior to 1.0.0, which stems from disclosing Intune service access tokens in debug mode, which could lead to information disclosure...

GHSA-V6R4-35F9-9RPW Hashicorp Vault has Login MFA Rate Limit Bypass Vulnerability

Vault and Vault Enterprise’s “Vault” login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

RSEC-2025-0 Arbitrary Code Execution (ACE) Vulnerability

A bug was identified in releases of the GH R package prior to version 1.5. This flaw could expose sensitive information, such as authentication tokens, through request headers during its operation if responses were cached to disk. We issued a Posit Security Advisory with the 1.5 release and...

pyjwt 安全漏洞

pyjwt is a Python library by the individual developer José Padilla in the United States. It allows encoding and decoding of JSON Web Tokens JWT. A security vulnerability exists in pyjwt version v2.10.1, which stems from the presence of weak encryption...

DEBIAN-CVE-2024-48916

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

AZL-66005 CVE-2024-48916 affecting package ceph for versions less than 18.2.2-10

Ceph is a distributed object, block, and file storage platform. In versions 19.2.3 and below, it is possible to send an JWT that has "none" as JWT alg. And by doing so the JWT signature is not checked. The vulnerability is most likely in the RadosGW OIDC provider. As of time of publication, a kno...

WordPress WebinarIgnition Authentication Bypass Vulnerability

WordPress WebinarIgnition is an open source plugin for WordPress that focuses on creating real-time interactive webinars. WordPress WebinarIgnition suffers from an authentication bypass vulnerability that stems from a lack of capability checking, which can be exploited by an attacker to generate...

Security Bulletin: IBM Storage Ceph is vulnerable to Aymmetric Resource Consumption and Improper Handling of Exceptions in Grafana (CVE-2024-51744 CVE-2025-30204)

Summary Grafana is used by IBM Storage Ceph as a metrics dashboard. This bulletin identifies the steps to take to address the vulnerability in Grafana. CVE-2024-51744 CVE-2025-30204 Vulnerability Details CVEID:CVE-2024-51744 DESCRIPTION: golang-jwt is a Go implementation of JSON Web Tokens. Uncle...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

Cross-Domain Token Exposure

Ollama is vulnerable to Cross-Domain Token Exposure. The vulnerability is due to improper handling of the realm value in the WWW-Authenticate header by the /api/pull endpoint, which allows an attacker to steal authentication tokens and bypass access controls...

sudo_inject

Linux Privilege Escalation by injecting process possessing sudo tokens Inject process that have valid sudo token and activate our own sudo token Introduction We all noticed that sometimes sudo doesn't ask us for a password because he remembers us. How does he remember us and how does he identifie...

CVE-2025-31952

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access...

CVE-2025-0249

HCL IEM is affected by an improper invalidation of access or JWT token vulnerability. A token was not invalidated which may allow attackers to access sensitive data without authorization...

CVE-2025-31952

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access...

CVE-2025-31952 HCL iAutomate is affected by an insufficient session expiration

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access...

CVE-2025-51864

A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...

PT-2025-30700 · Hcl · Hcl Iautomate

Name of the Vulnerable Software and Affected Versions: HCL iAutomate affected versions not specified Description: HCL iAutomate is affected by insufficient session expiration. This allows session tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized...

CVE-2025-4570

An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...

CVE-2025-51471

Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access controls via a malicious realm value in a WWW-Authenticate header returned by the /api/pull endpoint...