PT-2020-12695 · Intuit · Argo

Name of the Vulnerable Software and Affected Versions: Argo version v1.5.0 Description: The issue allowed attackers to determine the usernames of valid non-SSO accounts. This was possible because the /api/v1/session endpoint returned a 401 status code for an existing username and a 404 status cod...

RubyGems: Login credentials transmitted in cleartext on index.rubygems.org

If someone links their target to http://index.rubygems.org then if they click "sign in" their credentials are transmitted plaintext as there is no https redirect or enforcing of https on the login form. Step 1: Link to http://index.rubuygems.org Step 2: sniff traffic open wifi / proxy / etc See t...