37 matches found
CVE-2022-24342
CVE-2022-24342 JetBrains TeamCity - GitHub 인증의 CSRF를 통한 계정 탈취 PoC CVE-2022-24342 요구 사항 사용법 작동 방식 GitHub OAuth2: 쿼리 파라미터 처리 순서 CVE-2022-24342: HTTP 요청 흐름 요구 사항 JetBrains TeamCity 로컬 머신에서 익스플로잇을 실행하는 경우 Ngrok이나 대체 도구가 필요할 수 있습니다. $ ngrok http 8000 2. GitHub OAuth2 애플리케이션을 생성합니다: homepage:...
The vulnerability of the GitHub authentication provider for Kubernetes Rancher’s cluster management software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the GitHub authentication provider for Kubernetes Rancher software management systems is related to flaws in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
CVE-2026-41053
CVE-2026-41053 affects Rancher’s GitHub authentication provider, specifically the team membership expansion, where an incorrect authentication caching flaw could grant principal access to any logged-in user. Affected versions are 2.13 prior to 2.13.6 and 2.14 prior to 2.14.2. Root cause: faulty c...
CVE-2026-41053: Incorrect Implementation of Authentication Algorithm
Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via host resolution in the CLI authentication layer. An attacker can obtain authentication tokens intended for GitHub or GitHub Enterprise by causing authenticated requests to be sent to external hosts, as the ho...
GHSA-5WXR-W449-57CM Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions
Impact This affects only workflows that pin an exact affected Composer semver version through setup-php, for example tools: composer:2.9.7. Workflows using the default Composer version, composer:v2, or no pinned Composer version are not affected through setup-php, because those Composer URLs have...
PT-2026-41129
Name of the Vulnerable Software and Affected Versions shivammathur/setup-php versions 2.25.0 through 2.37.0 Description Command injection is possible when the action resolves the PHP version from repository-controlled files and incorporates these values into generated shell or PowerShell setup...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the GitHub OAuth callback handler when the refreshInterval query parameter is embedded verbatim into an error message and rendered unescaped into HTML. An attacker can execute arbitrary JavaScript in the...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the GitHub OAuth callback handler when the refreshInterval query parameter is embedded verbatim into an error message and rendered unescaped into HTML. An attacker can execute arbitrary JavaScript in the...
EUVD-2022-3138
Malicious code in bioql PyPI...
EUVD-2022-4543
Malicious code in bioql PyPI...
EUVD-2022-4779
Malicious code in bioql PyPI...
CVE-2019-10315
Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF...
CVE-2019-1003019
An session fixation vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...
CVE-2019-1003018
An exposure of sensitive information vulnerability exists in Jenkins GitHub Authentication Plugin 0.29 and earlier in GithubSecurityRealm/config.jelly that allows attackers able to view a Jenkins administrator's web browser output, or control the browser e.g. malicious extension to retrieve the...
CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...
Coder's OIDC authentication allows email with partially matching domain to register
Summary A vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the allowlist. Deployments are only affected if the OIDC provider allows users to create accounts on the provider such as publi...
Exploit for Cross-Site Request Forgery (CSRF) in Jetbrains Teamcity
CVE-2022-24342 JetBrains TeamCity - account takeover via CSRF...
Jenkins GitHub Authentication Plugin Cross-Site Request Forgery vulnerability
Jenkins GitHub Authentication Plugin did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins...
