43 matches found
EUVD-2018-2948
Malware in sbrugna...
EUVD-2021-26844
Malware in sbrugna...
EUVD-2011-2333
Malware in sbrugna...
EUVD-2022-45066
Malicious code in bioql PyPI...
EUVD-2022-28957
Malicious code in bioql PyPI...
MAL-2025-15103 Malicious code in authtoken-paypal (npm)
The package authtoken-paypal was found to contain malicious code...
Malicious code in authtoken-paypal (npm)
The package authtoken-paypal was found to contain malicious code...
CVE-2023-41904
Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...
CVE-2022-24042
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application returns an AuthToken that does not expire at the defined auto...
Information Disclosure
@sentry/react-native is vulnerable to Information Disclosure. The vulnerability is due to allowing auth tokens to be set in the optional authToken configuration parameter. This flaw potentially leads to Information Disclosure when built into the application bundle and published...
Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin
Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...
GHSA-68C2-4MPX-QH95 Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin
Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...
CVE-2023-41904
Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...
PT-2023-28159 · Zoho · Zoho Manageengine Admanager Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADManager Plus versions prior to 7203 Description: The issue allows 2FA bypass for AuthToken generation in REST APIs. Recommendations: For versions prior to 7203, update to version 7203 or later to resolve the issue. As a...
CVE-2023-0813
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without...
Authentication flaw
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without...
CVE-2023-0813
A flaw was found in the Network Observability plugin for OpenShift console. Unless the Loki authToken configuration is set to FORWARD mode, authentication is no longer enforced, allowing any user who can connect to the OpenShift Console in an OpenShift cluster to retrieve flows without...
Siemens Desigo PXC and DXR Devices Insufficient Session Expiration (CVE-2022-24042)
A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The web application returns an AuthToken that does not expire at the defined auto...
CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...
CVE-2022-41960 BigBlueButton contains DoS via failed authToken validation
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. Th...