PT-2023-27090 · Unknown · Tonton-Tei Line

Name of the Vulnerable Software and Affected Versions: TonTon-Tei Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For TonTon-Tei Line version 13.6.1, at the moment, there is...

CVE-2023-39737

The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PT-2023-27094 · Unknown · Matsuya Line

Name of the Vulnerable Software and Affected Versions: Matsuya Line version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Matsuya Line version 13.6.1, update to a version that fixe...

CVE-2023-39732

CVE-2023-39732 affects Tokueimaru Waiting Line 13.6.1. The issue is leakage of the client secret, which allows an attacker to obtain the channel access token and issue crafted broadcast messages. The available documents confirm the root cause as client secret leakage and the impact as token discl...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

Design/Logic Flaw

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-39731

The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

PT-2023-27088 · Unknown · Kaibutsunosato

Name of the Vulnerable Software and Affected Versions: Kaibutsunosato version 13.6.1 Description: The leakage of the client secret allows attackers to obtain the channel access token and send crafted broadcast messages. Recommendations: For Kaibutsunosato version 13.6.1, update to a version that...

CVE-2023-39731

The CVE-2023-39731 entry concerns Kaibutsunosato v13.6.1, where leakage of the client secret enables attackers to obtain the channel access token and issue crafted broadcast messages. Public sources in the connected documents consistently describe an information-disclosure flaw in the client that...

OAuth2 client_secret stored in plain text in the database

None...

Leyka < 3.30.7.1 - Subscriber+ Sensitive Information Disclosure

Description The plugin is vulnerable to Sensitive Information Exposure via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more...

Design/Logic Flaw

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

CVE-2023-4917 Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.7 via the 'leykaajaxgetenvandoptions' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API...

user_oidc app stores client secret unencrypted in database

None...

Authorization

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...

CVE-2023-32312 Client secret not mandatory in UmbracoIdentityExtensions

UmbracoIdentityExtensions is an Umbraco add-on package that enables easy extensibility points for ASP.Net Identity integration. In affected versions client secrets are not required which may expose some endpoints to untrusted actors. Since Umbraco is not a single-page application, the implicit fl...