2844 matches found
CVE-2020-8657
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token...
CVE-2020-8657
Incident summary (CVE-2020-8657): EyesOfNetwork 5.3 is affected by a hardcoded API key vulnerability. The default API key (EONAPI_KEY) is stored in include/api_functions.php for API version 2.4.2, enabling an attacker to calculate/guess the admin access token and potentially gain administrative a...
CVE-2020-8657: Use of Hard-coded Credentials
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token...
CVE-2020-8657
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. Recent assessments: Assessed Attack...
Starbucks: China - Leaked credentials permitted a limited ability to create Starbucks coupons and cards
neweq discovered a Github repository exposing credentials with which they could obtain an access token. The access token permitted limited access to generate Starbucks coupons and cards. @neweq — thank you for reporting this vulnerability...
Improper Authorization
Overview All versions of passport-cognito are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may...
CVE-2019-14782
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and the victim's token value from /usr/local/cwpsrv/logs/accesslog, then use them to make a request to extract the victim's password for the OS...
Mail.ru: Leak Sensetive Data at face.city-mobil.ru
Unrestricted git directory in face.city-mobil.ru could leak sensitive data including access token for internal repository...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
Security feature bypass
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
CVE-2013-4593 concerns the RubyGem omniauth-facebook. The connected sources describe a flaw where the access token can be transmitted via the URL, enabling a remote attacker to bypass authentication and impersonate another user. This results in an authentication bypass vulnerability within the om...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593
RubyGem omniauth-facebook has an access token security vulnerability...
CVE-2013-4593: Improper Authentication
RubyGem omniauth-facebook has an access token security vulnerability...
PT-2019-6955
Name of the Vulnerable Software and Affected Versions omniauth-facebook affected versions not specified Description The RubyGem omniauth-facebook has an access token security issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this...
CVE-2019-1458
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka ‘Win32k Elevation of Privilege Vulnerability’. Recent assessments: gwillcox-r7 at October 19, 2020 5:31pm UTC reported: Known as WizardOpium for its use in the...
Picsart: User account compromised authentication bypass via oauth token impersonation
OAuth token impersonation is actually a bug when 3rd party company app or malicious app collects the access token of the same user then that company can access to user account on PicsArt. The condition is that the user needs to authorized both PicsArt and malicious app with same Facebook or Googl...