CVE-2026-26196: Use of GET Request Method With Sensitive Query Strings

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and accesstoken, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2...

Qualys released QScanner – a console vulnerability scanner for container images

QualysreleasedQScanner - a console vulnerability scanner for container images. Feed it an image and get a list of vulnerabilities a la Trivy. It supports: " Local Runtimes: Scan images from Docker, Containerd, or Podman. Local Archives: Analyze Docker images or OCI layouts from local files. Remot...

CVE-2024-47822: Insertion of Sensitive Information into Log File

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

GO-2024-2882 github.com/huandu/facebook may expose access_token in error message.

github.com/huandu/facebook may expose accesstoken in error message...

CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

CVE-2024-35232

The CVE-2024-35232 issue affects github.com/huandu/facebook, a Go package for Facebook Graph API usage. The root cause is that an access_token can be exposed in error messages during HTTP request failures, enabling potential information disclosure if logs or clients capture those messages. The vu...

CVE-2024-35232: Generation of Error Message Containing Sensitive Information

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

GHSA-QHHJ-7HRC-GQJ5 Home Assistant vulnerable to account takeover via auth_callback login

Part of the Cure53 security audit of Home Assistant. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41893 Account takeover via auth_callback login in Home Assistant Core

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2023-41893: Exposure of Sensitive Information to an Unauthorized Actor

Home assistant is an open source home automation. The audit team’s analyses confirmed that the redirecturi and clientid are alterable when logging in. Consequently, the code parameter utilized to fetch the accesstoken post-authentication will be sent to the URL specified in the aforementioned...

CVE-2022-30735

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the accesstoken without permission...

CVE-2022-30735

CVE-2022-30735 affects Samsung Account prior to version 13.2.00.6, where improper privilege management allows an attacker to obtain an access_token without permission. The root cause is privilege mismanagement in Samsung Account’s access handling. Affected component: Samsung Account authenticatio...

CVE-2022-30735

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the accesstoken without permission...

CVE-2022-30735: Exposure of Sensitive Information to an Unauthorized Actor

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the accesstoken without permission...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2016-10986: Improper Neutralization of Input During Web Page Generation

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumerkey, consumersecret, accesstoken, and accesstokensecret...

CVE-2019-13337

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

CVE-2019-13337

WESEEK GROWI prior to 3.5.0 is affected. A flaw in site-wide basic authentication allows bypass by supplying the URL parameter access_token (the API parameter). No valid token is validated by the backend, enabling the website to be browsed as if authentication were not required. The core issue is...

CVE-2019-13337: Authorization Bypass Through User-Controlled Key

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter accesstoken this is the parameter used by the API. No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is...

Design/Logic Flaw

doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1K9 accesstoken in a uri=blog&action=index&controller=blog...