CVE-2025-0250

HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks...

CVE-2025-0250 HCL IEM is affected by an authorization token sent in cookie vulnerability

HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks...

CVE-2025-0250 HCL IEM is affected by an authorization token sent in cookie vulnerability

HCL IEM is affected by an authorization token sent in cookie vulnerability. A token used for authentication and authorization is being handled in a manner that may increase its exposure to security risks...

CVE-2025-0250

CVE-2025-0250 affects HCL IEM. Multiple sources describe an authorization token used in cookies that may increase exposure of authentication/authorization data. The PT Security entry notes affected HCL IEM versions exist but does not specify a fixed version; no newer version containing a fix is d...

PT-2025-30709 · Hcl · Hcl Iem

Name of the Vulnerable Software and Affected Versions: HCL IEM affected versions not specified Description: HCL IEM is affected by an authorization token sent in a cookie, which may increase its exposure to security risks. The token used for authentication and authorization is being handled in a...

Ollama 安全漏洞

Ollama is an Ollama open source large-scale language model that can be started and run locally. A security vulnerability exists in Ollama version 0.6.7, which stems from a cross-domain token exposure vulnerability in server.auth.getAuthorizationToken that could lead to bypassing access control...

CVE-2024-34457

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config. Mitigation: all users should upgrade to 2.1.4...

CVE-2023-33077

Memory corruption in HLOS while converting from authorization token to HIDL vector...

CVE-2023-20252

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-3263

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass in the REST API due to the mishandling of special characters when parsing credentials.Successful exploitation allows the malicious agent to obtain a valid authorization token and read...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the makeRequestWithRetry and getAuthorizationToken functions. An attacker can cause the server to crash by sending a specially crafted gzip bomb HTTP response. Details Denial of Service DoS describes a family o...

PT-2025-12033 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version latest Description: The issue allows an attacker to view the content of any dataset without authorization by sending a GET request to the "/v1/datasets" endpoint without a valid authorization token. Recommendations: F...

CVE-2024-1902

lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker...

PT-2024-17502

Name of the Vulnerable Software and Affected Versions Shenzhen Dashi Tongzhou Information Technology AgileBPM version 1.0.0 Description A critical issue has been found, affecting the doFilter function of the AuthorizationTokenCheckFilter.java file. This leads to improper access controls, allowing...

CVE-2024-30896

A flaw was found in InfluxDB. This vulnerability allows privilege escalation, leading to unrestricted access to the InfluxDB instance via improper authorization token management. Attackers with a valid allAccess token can enumerate and obtain operator-level tokens. Mitigation Mitigation for this...

Apache Answer: Predictable Authorization Token Using UUIDv1

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...

CVE-2024-45719 Apache Answer: Predictable Authorization Token Using UUIDv1

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. A security vulnerability exists in IBM Concert version 1.0 that stems from not setting a security attribute on an authorization token or session cookie...

IBM Concert Information Disclosure Vulnerability

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. A security vulnerability exists in IBM Concert version 1.0 that stems from not setting a security attribute on an authorization token or session cookie...

GHSA-635V-PC42-FR74 AWS SageMaker Training Toolkit logs CodeArtifact Authorization token

Description For SageMaker Training Toolkit1 versions 4.7.4; 4.7.3; 4.7.2; 4.7.1; 4.7.0, the authorization tokens for CodeArtifact temporary token with an expiration of 12 hours were logged in the log files when the CodeArtifact capability was enabled. If customers push these log files to their...