421 matches found
CVE-2025-13829
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...
EUVD-2025-200016
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...
CVE-2025-13829
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...
CVE-2025-13829
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...
CVE-2025-13829
Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any other user. Critical information retrieved: APIKEY 1 year user Session RefreshToken 10 minutes user Session Password hashed with bcrypt User IP Email Full Na...
CVE-2025-13829
CVE-2025-13829 affects Data Illusion Zumbrunn NGSurvey and is described as an Incorrect Authorization vulnerability that lets any logged-in user access private data of other users. Publicly reported details across multiple sources (NVD, Red Hat, EUVD, CVE.org, CNNVD, etc.) enumerate sensitive dat...
PT-2025-48486
Name of the Vulnerable Software and Affected Versions Data Illusion Zumbrunn NGSurvey affected versions not specified Description An incorrect authorization issue exists in Data Illusion Zumbrunn NGSurvey, allowing any authenticated user to access the private information of other users. This...
keycloak: org.keycloak:keycloak-services: User can refresh offline session even after client's offline_access scope was removed
A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...
CVE-2025-12110
A flaw was found in Keycloak. An offline session continues to be valid when the offlineaccess scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and...
EUVD-2022-4944
Malicious code in bioql PyPI...
EUVD-2022-5092
Malicious code in bioql PyPI...
EUVD-2024-29109
Malicious code in bioql PyPI...
EUVD-2022-6938
Malicious code in bioql PyPI...
EUVD-2025-21181
Malicious code in bioql PyPI...
EUVD-2023-0262
Malicious code in bioql PyPI...
EUVD-2025-29435
Malicious code in bioql PyPI...
Insufficient Session Expiration
github.com/coder/coder/v2 is vulnerable to Insufficient Session Expiration. The vulnerability is due to session expiration bypass due to Coder allowing a web session to remain active when the OpenID Connect provider does not return a refresh token, so the session can continue past the IdP-issued...
GO-2025-3921 Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder...
PT-2025-36646
Coder accepts an APIKey beyond the linked OIDC expiry if there is no refresh token in github.com/coder/coder...
Use of a Key Past its Expiration Date
Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to improper enforcement of OIDC token expiry in the authentication process when no refresh token is provided. An attacker can maintain unauthorized access to the service by continuously using a...