CVE-2022-22412

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user with access to the local host client machine to obtain a login access token. IBM X-Force ID: 223019...

CVE-2022-22412

CVE-2022-22412 affects IBM Robotic Process Automation, versions older than 21.0.3. A local-host user can obtain a login access token due to insufficient access control on token handling. The IBM Security Bulletin and related records confirm the affected versions and provide a fix path: update to ...

PT-2022-15415 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation versions 21.0.0 through 21.0.2 Description: The issue allows a user with access to the local host client machine to obtain a login access token. Recommendations: For versions 21.0.0 through 21.0.2, at the moment...

IBM Robotic Process Automation 访问控制错误漏洞

IBM Robotic Process Automation is a robotic process automation product from IBM USA. It helps you automate more business and IT processes at scale with the ease and speed of traditional RPA. An Access Control Error vulnerability exists in IBM Robotic Process Automation version 21.0.0, 21.0.1, and...

WordPress OAuth Single Sign On plugin authorization issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An authorization issue...

CVE-2022-2133

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address...

CVE-2022-2133 OAuth Single Sign On < 6.22.6 - Authentication Bypass

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address...

CVE-2022-34093

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via accesstoken.php...

CVE-2022-34093

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via accesstoken.php...

Insecure Session

github.com/flyteorg/flyteadmin is vulnerable to insecure session. The vulnerability exists in ValidateAccessToken function in resourceserver.go because the access token keys are not properly validated which allows an attacker to access the server using expired tokens...

i3geo 跨站脚本漏洞

i3geo is a saladesituacao open source application for developing interactive web maps. A security vulnerability exists in Portal do Software Publico Brasileiro i3geo version v7.0.5, which originates from the presence of XSS in accesstoken.php...

CVE-2022-1245

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...

CVE-2022-1245

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...

Amazon Photos vulnerability could have given attackers access to user files and data

Amazon has patched a flaw in the Amazon Photos app which could have allowed an attacker to steal and use a users unique access token that verifies their identity across multiple Amazon APIs. That would give attackers access to a trove of information, since many of these APIs contain personal data...

OAuth Single Sign On < 6.22.6 - Authentication Bypass

The plugin doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address. PoC POST / HTTP/1.1 Accept: / Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type:...

Malicious code in js-access-token-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29f1084998eda8c1dc41acf9498dece23356295d341e62f57883b8f5be2125c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4056 Malicious code in js-access-token-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29f1084998eda8c1dc41acf9498dece23356295d341e62f57883b8f5be2125c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Samsung Account Privilege Management Improper Vulnerability (CNVD-2022-64086)

Samsung Account is a cell phone account from Samsung South Korea. versions prior to Samsung Account 13.2.00.6 contain a privilege management vulnerability that could be exploited by attackers to obtain accesstoken without permission...

CVE-2022-29241

Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of rootdir that contains the starting user's home directory, then the underlying REST API ca...

DEBIAN-CVE-2022-29241

Jupyter Server provides the backend i.e. the core services, APIs, and REST endpoints for Jupyter web applications like Jupyter Notebook. Prior to version 1.17.1, if notebook server is started with a value of rootdir that contains the starting user's home directory, then the underlying REST API ca...