GitLab: Login email verification bypass via `/oauth/token`.

Vulnerability description not provided...

Remote Command Execution Vulnerability in H2 Component of e-cology Product of Panmicro Networks Technology Co.

e-cology is a new and efficient collaborative office system created by Panavision for medium and large organizations. A remote command execution vulnerability exists in the H2 component of the e-cology product of Panmicro Networks Technology Co. The vulnerability allows obtaining an administrator...

CVE-2024-6337

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

CVE-2024-31842

Italtel Embrace 1.6.4 is affected by a vulnerability where the web application inserts an authenticated user’s access token into GET requests. The token appears in the URL’s query string and can be stored in browser history, Referer headers, web logs, or other sources, enabling attackers to use t...

Italtel Embrace 安全漏洞

Italtel Embrace is a software-only, cloud-enabled Web application server from Italtel. It can be used to enable WebRTC services in a TLC network or as a standalone WebRTC service. A security vulnerability exists in Italtel Embrace version 1.6.4, which originates when the web application inserts a...

CVE-2024-31842

An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...

The vulnerability of the Single Sign-On (SSO) function of the SAP BusinessObjects Business Intelligence platform allows a hacker to gain full access to the device.

The vulnerability of the Single Sign-On SSO function of the SAP BusinessObjects Business Intelligence platform is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full access to the device by obtaining an...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab, which stems from the possibility th...

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise allows a malicious actor to obtain confidential calendar information using an access token with an expired validity period.

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain confidential calendar information using ...

The vulnerability of the Access Token Handler component of the JetBrains YouTrack software suite for managing projects and tasks allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Access Token Handler component of the JetBrains YouTrack software for managing projects and tasks is related to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to...

CVE-2024-5566

An improper privilege management vulnerability allowed users to migrate private repositories without having appropriate scopes defined on the related Personal Access Token. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.14 and was fixed in version 3.13.1, 3.12.6,...

CVE-2024-5816 Improper authorization allows persistent access in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a suspended GitHub App to retain access to the repository via a scoped user access token. This was only exploitable in public repositories while private repositories were not impacted. This...

CVE-2024-5816

CVE-2024-5816 – GitHub Enterprise Server : An Incorrect Authorization flaw allows a suspended GitHub App to retain access to repositories via a scoped user access token. Impact is limited to public repositories; private repos are not affected. Affected: all GitHub Enterprise Server versions prior...

PT-2024-36574 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.14 Description: An improper privilege management issue allowed users to migrate private repositories without having the appropriate scopes defined on the related Personal Access Token...

CVE-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...

CVE-2024-37905

The CVE-2024-37905 entry concerns the github.com/goauthentik/authentik project. Affected: authentic API-Access-Token mechanism that can be exploited to gain admin privileges, enabling full admin access and actions like resetting passwords. Root cause: improper access control/authorization related...

CVE-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including...

PT-2024-27821

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.2.4 authentik versions prior to 2024.4.2 authentik versions prior to 2024.4.3 authentik versions prior to 2024.6.0 Description The authentik API-Access-Token mechanism can be exploited to gain admin user...