Lucene search
K

18 matches found

Github Security Blog
Github Security Blog
added 2026/05/28 5:22 p.m.8 views

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Description The Mailjet mailer bridge and the LOX24 SMS notifier bridge both ship webhook request parsers used to authenticate and decode the event callbacks each provider POSTs to an application's webhook endpoint. Their doParseRequest $request, \SensitiveParameter string $secret methods receive...

5.7AI score0.00103EPSS
Exploits0References7Affected Software3
RedhatCVE
RedhatCVE
added 2026/03/26 3:2 p.m.2 views

CVE-2026-32865

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing...

9.8CVSS5.9AI score0.00062EPSS
Exploits0References1
EUVD
EUVD
added 2026/03/19 6:31 p.m.2 views

EUVD-2026-13122

OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing...

9.8CVSS5.9AI score0.00062EPSS
Exploits0References3
OSV
OSV
added 2025/10/11 1:20 p.m.3 views

OESA-2025-2396 ongres-scram security update

Scram is part of the family of Simple Authentication and Security Layer authentication mechanisms.It is described as part of RFC 5802 and RFC7677. This pachage is a Java implementation. Security Fixes: SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple...

8.7CVSS7AI score0.00099EPSS
Exploits0References2
CVE
CVE
added 2025/06/03 8:33 p.m.103 views

CVE-2025-49001

DataEase (open source BI tool) prior to 2.10.10 is affected by an authentication bypass: secret verification does not take effect, allowing a JWT to be forged with any secret. Multiple sources confirm the issue and its fix in version 2.10.10. Remediation is to upgrade to 2.10.10 or later; no publ...

9.8CVSS7AI score0.07369EPSS
Exploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2025/06/03 12:0 a.m.4 views

PT-2025-23670 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.10 Description: The issue concerns ineffective secret verification in DataEase, allowing a user to forge a JWT token using any secret. This could potentially lead to unauthorized access. The problem has been...

9.8CVSS6AI score0.07369EPSS
Exploits0References11
RedhatCVE
RedhatCVE
added 2025/05/23 3:19 a.m.3 views

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

7.8CVSS7.5AI score0.00008EPSS
Exploits1References1
OSV
OSV
added 2023/10/12 8:15 p.m.2 views

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

7.8CVSS5.8AI score
Exploits0References2
Cvelist
Cvelist
added 2023/10/12 12:0 a.m.20 views

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

7.8AI score0.00008EPSS
Exploits1References1
NVD
NVD
added 2023/06/16 9:15 a.m.12 views

CVE-2023-2783

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps...

4.3CVSS4.4AI score0.00177EPSS
Exploits0References1
Vulnrichment
Vulnrichment
added 2023/06/16 8:39 a.m.8 views

CVE-2023-2783 App Framework does not checks for the secret provided in the incoming webhook request

Mattermost Apps Framework fails to verify that a secret provided in the incoming webhook request allowing an attacker to modify the contents of the post sent by the Apps...

4.3CVSS6.6AI score0.00177EPSS
Exploits0References1
Positive Technologies
Positive Technologies
added 2023/06/16 12:0 a.m.3 views

PT-2023-21366 · Mattermost · Mattermost Apps Framework

Name of the Vulnerable Software and Affected Versions: Mattermost Apps Framework affected versions not specified Description: The issue concerns a failure to verify secrets in incoming webhook requests, allowing an attacker to modify the contents of posts sent by the Apps. Recommendations: At the...

4.3CVSS4.1AI score0.00177EPSS
Exploits0References6
OSV
OSV
added 2022/08/27 12:0 a.m.27 views

GHSA-CC99-WHM5-MMQ3 Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is...

9.1CVSS7.3AI score0.00041EPSS
Exploits1References11
OSV
OSV
added 2022/08/26 4:15 p.m.1 views

DEBIAN-CVE-2021-3563

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity...

7.4CVSS6.5AI score0.00041EPSS
Exploits1References1
OSV
OSV
added 2022/05/13 1:30 a.m.0 views

GHSA-449Q-V4J2-5H8P Jenkins allows Exposure of Sensitive Information to an Unauthorized Actor

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

6.9CVSS6AI score0.00121EPSS
Exploits0References5
RedHat Linux
RedHat Linux
added 2016/03/22 4:49 p.m.3 views

jenkins: Secret key not verified when connecting a slave (SECURITY-184)

Jenkins before 1.638 and LTS before 1.625.2 do not properly verify the shared secret used in JNLP slave connections, which allows remote attackers to connect as slaves and obtain sensitive information or possibly gain administrative access by leveraging knowledge of the name of a slave...

5CVSS7.4AI score0.00121EPSS
Exploits0References5
Friends Of PHP
Friends Of PHP
added 1970/01/01 12:0 a.m.4 views

CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection

More info at https://symfony.com/cve-2026-45754...

5.8AI score0.00103EPSS
Exploits0Affected Software1
Friends Of PHP
Friends Of PHP
added 1970/01/01 12:0 a.m.0 views

CVE-2026-45754: Mailjet Mailer and LOX24 Notifier Webhook Parsers Never Verify the Configured Secret: Unauthenticated Webhook Event Injection

More info at https://symfony.com/cve-2026-45754...

5.8AI score0.00103EPSS
Exploits0Affected Software1
Rows per page
Query Builder