CVE-2022-31677

An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...

Session fixation

An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...

CVE-2022-1663

CVE-2022-1663 describes an information-disclosure/credential-bypass issue in the WordPress Stop Spam Comments plugin (versions ≤ 0.2.1.2). The vulnerability stems from improper generation of the Javascript access token (ssc_key) intended to prevent abuse of the comment section, allowing an attack...

CVE-2022-1663 Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request...

CVE-2022-31677

An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...

VMware Pinniped Supervisor 代码问题漏洞

Supervisor is a process control system for Unix-like systems. The system is primarily used to monitor and control processes in Unix-like operating systems.VMware Pinniped is a software from VMware that provides identity services for Kubernetes. A security vulnerability exists in VMware Pinniped...

PT-2022-14032 · WordPress · Stop Comment Spam

Name of the Vulnerable Software and Affected Versions: Stop Spam Comments WordPress plugin versions 0.2.1.2 and earlier Description: The issue arises from the improper generation of the Javascript access token, which is intended to prevent abuse of the comment section. This allows threat authors ...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

Cross site scripting

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

CVE-2022-35910

In Jellyfin before 10.8, stored XSS allows theft of an admin access token...

CVE-2022-35910

CVE-2022-35910 : The provided documents describe a stored XSS vulnerability in Jellyfin before version 10.8 that enables theft of an admin access token. The description does not specify the exact component, file, or version other than the product and pre-10.8 range, nor does it include explicit r...

GitLab 12.6 < 15.0.5 / 15.1 < 15.1.4 / 15.2 < 15.2.1 (CVE-2022-2497)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A...

Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. PoC Collect the name and value of ssckey for the target post and use it on the request. curl...

Stop Spam Comments <= 0.2.1.2 - Access Token Bypass

The plugin does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. Collect the name and value of ssckey for the target post and use it on the request. curl...

WordPress Stop Spam Comments plugin <= 0.2.1.2 - Access Token Bypass vulnerability

Access Token Bypass vulnerability discovered by Daniel Ruf in WordPress Stop Spam Comments plugin versions = 0.2.1.2. Solution Deactivate and delete. This plugin has been closed as of August 3, 2022 and is not available for download. This closure is temporary, pending a full review...

CVE-2022-2497

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL...

CVE-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

CVE-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

Design/Logic Flaw

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

CVE-2022-2497

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. A malicious developer could exfiltrate an integration's access token by modifying the integration URL...