CVE-2023-39735

The leakage of the client secret in UomasaSaijinews Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39740

Onigiriya-musubee Line 13.6.1 is reported to leak the client secret, enabling an attacker to obtain the channel access token and send crafted broadcast messages. Root cause: improper handling/storage of the client secret leading to exposure. Impact: potential impersonation and unauthorized broadc...

CVE-2023-39737

The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39732

CVE-2023-39732 affects Tokueimaru Waiting Line 13.6.1. The issue is leakage of the client secret, which allows an attacker to obtain the channel access token and issue crafted broadcast messages. The available documents confirm the root cause as client secret leakage and the impact as token discl...

CVE-2023-39736

The CVE-2023-39736 entry concerns leakage of the client secret in Fukunaga_memberscard version 13.6.1, enabling an attacker to obtain the channel access token and send crafted broadcast messages. Public records consistently point to this leakage as the root cause, with a high-severity CVSS v3.1 s...

PT-2023-27095 · Unknown · Regina Sweets&Bakery Line

Name of the Vulnerable Software and Affected Versions: REGINA SWEETS&BAKERY Line version 13.6.1 Description: The issue allows attackers to obtain the channel access token and send crafted broadcast messages due to the leakage of the client secret. Recommendations: For REGINA SWEETS&BAKERY Line...

PT-2023-27097 · Unknown · Onigiriya-Musubee Line

Name of the Vulnerable Software and Affected Versions: Onigiriya-musubee Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Onigiriya-musubee Line version 13.6.1, update to...

CVE-2023-39733

The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39735

The leakage of the client secret in UomasaSaijinews Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PT-2023-27090 · Unknown · Tonton-Tei Line

Name of the Vulnerable Software and Affected Versions: TonTon-Tei Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For TonTon-Tei Line version 13.6.1, at the moment, there is...

CVE-2023-39737

The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39740

The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39734

CVE-2023-39734 affects VISION MEAT WORKS TrackDiner10/10_mc Line v13.6.1. The leakage of the client secret can allow an attacker to obtain the channel access token and send crafted broadcast messages, with CVSS 3.1 base score 8.2 (HIGH) and attack vector NETWORK, complexity LOW, user interaction ...

PT-2023-27091 · Unknown · Vision Meat Works Trackdiner10/10 Mc Line

Name of the Vulnerable Software and Affected Versions: VISION MEAT WORKS TrackDiner10/10 mc Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For version 13.6.1, consider...

Broken Authentication

homeassistant is vulnerable due to Broken Authentication. An attacker could exploit this vulnerability by tricking a user into clicking on a malicious link. The link would direct the user to a malicious website that would initiate the OAuth2 login process with a specially crafted redirect URI. If...

CVE-2023-41893

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PYSEC-2023-214

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

Design/Logic Flaw

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41893

CVE-2023-41893 affects Home Assistant Core. The vulnerability arises because the login flow allows altering redirect_uri and client_id, causing the code parameter used to fetch the access_token to be sent to a URL controlled by an attacker. This enables an account-takeover attempt if a victim aut...