Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it...

GHSA-CH86-PXR9-J9H9 Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it...

CVE-2026-34511

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption...

CVE-2026-34511 OpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter

OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview sylius/sylius is a platform for PHP, based on Symfony framework. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through a race condition in the promotion and coupon usage limit enforcement process. An attacker can redeem limited-use...

EUVD-2026-10920

Sylius has a Promotion Usage Limit Bypass via Race Condition...

Malicious code in epic-code-redemption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c2dca396c58a7835f926d93ff92bf48e87977c82dfe773546e2f7e3d11a7e9 The package epic-code-redemption was found to contain malicious code...

MAL-2025-49120 Malicious code in epic-code-redemption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c2dca396c58a7835f926d93ff92bf48e87977c82dfe773546e2f7e3d11a7e9 The package epic-code-redemption was found to contain malicious code...

EUVD-2025-37173

Malicious code in epic-code-redemption npm...

HackerOne: Lack of Validation in Reward Redemption Allows Unlimited Burp Suite License Abuse

A vulnerability was discovered in the reward redemption process of a points and rewards system. The vulnerability allowed an attacker to obtain multiple valid Burp Suite Pro licenses by using different email addresses, without any validation or verification tied to the user's account. The email...

EUVD-2020-23316

Malware in sbrugna...

EUVD-2025-25352

Malicious code in bioql PyPI...

CVE-2023-2733

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated...

CVE-2024-58248

nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards...

CVE-2024-58248

nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards...

nopCommerce 安全漏洞

nopCommerce is an open source, general purpose e-commerce platform from nopCommerce, Inc. A security vulnerability exists in nopCommerce versions prior to 4.80.0 that stems from a lack of locking mechanism for order placement, which could lead to double redemption of gift cards...

CVE-2024-58248

nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards...

CVE-2020-36841 WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation

The WooCommerce Smart Coupons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the woocommercecouponadmininit function in versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to send themselves gift certificates ...

BIT-DISCOURSE-2022-31096 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite h...

The _transferToBeneficiary() incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1.

Lines of code Vulnerability details Impact The transferToBeneficiary function of EthenaMinting.sol incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1. Proof of Concept The transferToBeneficiary function is used in redeem function of EthenaMinting.sol. Though, you are not allowed ...