Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the Delete function. An attacker can permanently remove entire repositories, including all associated data and history, by sending a DELETE request to the API endpoint while possessing only read-level access...

PT-2021-18384 · Pomerium · Pomerium

Name of the Vulnerable Software and Affected Versions: Pomerium versions 0.10.0 through 0.13.3 Description: The issue is related to an Open Redirect in the user sign-in/out process. Some API endpoints under /.pomerium/ do not verify parameters with pomerium signature, which could allow modifying...