Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is in WHITELISTURLS, meaning it requires no authentication. It decrypts the stored credential containing clientId, clientSecret, refreshtoken, sends a refresh request to the configured OAuth provider, a...

CVE-2021-22279

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port...

Authentication flaw

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port...

CVE-2021-22279

The CVE-2021-22279 entry concerns RobotWare for the OmniCore robot controller, where a Missing Authentication vulnerability allows an attacker with access to the Connected Services Gateway Ethernet port to read and modify files on the robot controller. The issue is attributed to missing auth cont...

CVE-2021-22279 OmniCore RobotWare Missing Authentication Vulnerability

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port...

CVE-2021-22279

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and modify files on the robot controller if the attacker has access to the Connected Services Gateway Ethernet port...

CVE-2018-1999034

A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to...