CVE-2024-8754

Removed by vendor...

CVE-2024-8754

GitLab CVE-2024-8754 affects GitLab EE/CE versions 16.9.7–16.9.x, 17.1.x, 17.2.x, and 17.3.x prior to patch releases. The issue is an improper input validation that allows account squatting by linking arbitrary unclaimed provider identities when JWT authentication is enabled. Affected versions re...

CVE-2024-8754 External Control of Critical State Data in GitLab

An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is...

PT-2024-39228 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 16.9.7 through 17.1.7 GitLab EE/CE versions 17.2 through 17.2.5 GitLab EE/CE versions 17.3 through 17.3.2 Description: An issue has been discovered in GitLab EE/CE, allowing an attacker to squat on accounts via linking...

GitLab 16.9.7 < 17.1.7 / 17.2 < 17.2.5 / 17.3 < 17.3.2 (CVE-2024-8754)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to...

CVE-2024-8005

A vulnerability was found in demozx gfcms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. Th...

CVE-2024-8005

Summary of CVE-2024-8005 (demozx gf_cms) : A vulnerability in demozx gf_cms versions 1.0 and 1.0.1 affects the JWT Authentication component, specifically the init function in internal/logic/auth/auth.go. The issue allows manipulation of hard-coded credentials, enabling remote exploitation. The se...

CVE-2024-8005 demozx gf_cms JWT Authentication auth.go init hard-coded credentials

A vulnerability was found in demozx gfcms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. Th...

CVE-2024-8005 demozx gf_cms JWT Authentication auth.go init hard-coded credentials

A vulnerability was found in demozx gfcms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. Th...

CVE-2024-8005 demozx gf_cms JWT Authentication auth.go init hard-coded credentials

A vulnerability was found in demozx gfcms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file internal/logic/auth/auth.go of the component JWT Authentication. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. Th...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.1 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.1 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2024-5798 Vault Incorrectly Validated JSON Web Tokens (JWT) Audience Claims

Vault and Vault Enterprise did not properly validate the JSON Web Token JWT role-bound audience claim when using the Vault JWT auth method. This may have resulted in Vault validating a JWT the audience and role-bound claims do not match, allowing an invalid login to succeed when it should have be...

CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...

CVE-2024-5037

CVE-2024-5037 – OpenShift Telemeter JWT iss check bypass : The vulnerability affects OpenShift’s Telemeter component, where a forged JWT can bypass the issuer (

CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...

CVE-2024-5037

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue "iss" check during JSON web token JWT authentication...

djangorestframework-simplejwt 5.3.1 - Information Disclosure Exploit

Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure Date: 26/01/2024 Exploit Author: Dhrumil Mistry dmdhrumilmistry Vendor Homepage: https://github.com/jazzband/djangorestframework-simplejwt/ Software...

CVE-2024-28255

OpenMetadata contains a flaw in the JwtFilter authentication check: the code may treat certain requests as excluded endpoints due to path parameters, allowing requests to bypass JWT validation and reach protected endpoints. The issue enables authentication bypass and, in combination with SpEL inj...

CVE-2024-28255

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

CVE-2023-36647

A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens...