Authentication Bypass

sentry is vulnerable to Authentication Bypass. The vulnerability exists due to the lack of a OIDC signing token inside the authentication mechanism which allows an attacker with sufficient client-side exploits to get a valid OAuth token for another user...

CVE-2017-0897

ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...