CVE-2019-14365

The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

CVE-2019-14365

The CVE-2019-14365 entry concerns the WordPress Intercom plugin (versions around 1.2.1/1.2.2). The vulnerability is a leakage of a Slack Access Token embedded in the plugin’s source code, enabling an attacker to access Slack-related data (channels, members, etc.). Details across connected sources...

CVE-2019-14367

Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

CVE-2019-14367

Slack-Chat (a jQuery-based web chat app) up to version 1.5.5 leaks a Slack Access Token in its source code. This information disclosure can allow an attacker to access Slack data such as channels and members. The connected documents do not specify a remediation or published exploitation details.

PT-2019-13644

Name of the Vulnerable Software and Affected Versions Intercom plugin for WordPress versions through 1.2.1 Description The issue allows an attacker to obtain significant information about the victim's Slack, including channels and members, by leaking a Slack Access Token in the source code...

CVE-2019-14366: Exposure of Sensitive Information to an Unauthorized Actor

WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

CVE-2019-14367: Exposure of Sensitive Information to an Unauthorized Actor

Slack-Chat through 1.5.5 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

WP Intercom Slack <= 1.2.2 - Slack Access Token Disclosure

The Intercom plugin through 1.2.2 leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

WP Slacksync < 1.8.6 - Slack Access Token Disclosure

The wpslacksync leaked a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

PT-2019-13646

Name of the Vulnerable Software and Affected Versions Slack-Chat versions 1.5.5 and earlier Description The issue allows an attacker to obtain a Slack Access Token from the source code, potentially revealing significant information about the victim's Slack environment, including channels and...

PT-2019-13645

Name of the Vulnerable Software and Affected Versions WP SlackSync plugin versions prior to 1.8.6 Description The WP SlackSync plugin for WordPress has an issue where it leaks a Slack Access Token in its source code. This leak allows an attacker to obtain significant information about the victim'...

CVE-2019-14365: Exposure of Sensitive Information to an Unauthorized Actor

The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about the victim's Slack channels, members, etc...

Potential session hijack in Apache CXF

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

GHSA-CW6W-Q88J-6MQF Potential session hijack in Apache CXF

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

Authentication Bypass

cxf-rt-rs-security-oauth2 is vulnerable to authentication bypass. The vulnerability exists as the access token services does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. An attacker with a an authorization code that is issued to...

CVE-2019-12419

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

Design/Logic Flaw

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

CVE-2019-12419

CVE-2019-12419 affects Apache CXF OpenId Connect token service prior to CXF 3.3.4 and 3.2.11, where the authenticated principal is not validated against the supplied clientId in the request. This could allow an attacker who obtained an authorization code for one client to exchange it for an acces...

CVE-2019-12419

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...

CVE-2019-12419

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...