CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session...

CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session...

CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session...

Improper access control

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session...

CVE-2021-45074

JFrog Artifactory before 7.29.3 and 6.23.38, is vulnerable to Broken Access Control, a low-privileged user is able to delete other known users OAuth token, which will force a reauthentication on an active session or in the next UI session...

CVE-2021-45074

CVE-2021-45074 affects JFrog Artifactory prior to version 7.29.3 and prior to 6.23.38. The issue is a Broken Access Control where a low-privileged user can delete other known users’ OAuth tokens, forcing reauthentication on an active session or the next UI session. Connected sources include Red H...

PT-2022-12300 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.29.3 JFrog Artifactory versions prior to 6.23.38 Description: The issue is related to Broken Access Control, where a low-privileged user can delete other known users' OAuth token. This action forces a...

OAuth consent phishing, in the wild

TL;DR An interesting incident response investigation showed exploitation of a recent OAuth related consent-phishing issue. We had been asked to investigate as the organisation had noticed some odd behaviours in the mailbox of one of the exec team. The mailbox was being queried using GraphAPI and...

OESA-2022-1531 grafana security update

Metrics dashboard and graph editor. Security Fixes: Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token and no other user credentials will...

CVE-2021-30650

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

CVE-2021-30650

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

CVE-2021-30650

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

CVE-2021-30650

A reflected cross-site scripting XSS vulnerability in the Symantec Layer7 API Management OAuth Toolkit OTK allows a remote attacker to craft a malicious URL for the OTK web UI and target OTK users with phishing attacks or other social engineering techniques. A successful attack allows injecting...

CVE-2021-30650

The CVE-2021-30650 issue affects Symantec Layer7 API Management OAuth Toolkit (OTK). It is a reflected XSS vulnerability where a remote attacker can craft a malicious URL targeting the OTK web UI, enabling injection of arbitrary code into the OTK web UI client application. Impact is described as ...

Pivotal Concourse Open Redirect in Login Flow

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse...

Grafana Authentication Bypass

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. Specific Go Packages Affected github.com/grafana/grafana/pkg/api...

GHSA-9689-RX4V-CQGC Pivotal Concourse Open Redirect in Login Flow

Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites. A remote unauthenticated attacker could convince a user to click on a link using the oAuth redirect link with an untrusted website and gain access to that user's access token in Concourse...

GHSA-RGJG-66CX-5X9M Grafana Authentication Bypass

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. Specific Go Packages Affected github.com/grafana/grafana/pkg/api...

Apache Traffic Control code issue vulnerability

Apache Traffic Control is a distributed, scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6 was vulnerable to a code issue that allowed unprivileged users who could reach traffic operations via HTTPS to send a special POST...