976 matches found
PT-2024-38044 · Unknown · Open-Webui
Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: A vulnerability exists where a token is returned when a user with a pending role logs in, allowing the user to perform actions without admin confirmation and bypassing the intended approval...
CVE-2024-25702
There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in the site configuration which when clicked could potentially execute arbitrary JavaScri...
Unspecified Vulnerability in JetBrains YouTrack
JetBrains YouTrack is a project management tool that supports cloud hosting and local deployment, and is primarily geared towards team collaboration management, especially suitable for software development, human resources, marketing, and other scenarios. JetBrains YouTrack suffers from a securit...
CVE-2024-45229
The Versa Director offers REST APIs for orchestration and management. By design, certain APIs, such as the login screen, banner display, and device registration, do not require authentication. However, it was discovered that for Directors directly connected to the Internet, one of these APIs can ...
CVE-2024-45229
Versa Director exposes certain REST APIs (login, banner, device registration) without authentication. A GET request with invalid arguments can be exploited by Directors connected to the Internet to obtain authentication tokens of other logged-in users, which can be used to call additional APIs on...
CVE-2024-47162
In JetBrains YouTrack before 2024.3.44799 token could be revealed on Imports page...
GitLab 安全漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A security vulnerability exists in GitLab CE/EE versions prior to 13.7 through...
Gitlab -- vulnerabilities
Gitlab reports: Execute environment stop actions as the owner of the stop action job Prevent code injection in Product Analytics funnels YAML SSRF via Dependency Proxy Denial of Service via sending a large glmsource parameter CIJOBTOKEN can be used to obtain GitLab session token Variables from...
Pluto 注入漏洞
Pluto is a unique language for Lua open-sourced by PlutoLang. It is used for general-purpose programming. An injection vulnerability exists in Pluto versions 0.9.0 through 0.9.4, which stems from the fact that scripts passing user-controlled values to the http.request header value can be affected...
CVE-2024-6586
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF request when exported, via a POST request to...
CVE-2024-45036 Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link
Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the TOPHATAPPTOKEN token stored in /.tophatrc through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send this token to the attacker's server without...
CVE-2024-45036 Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link
Tophat is a mobile applications testing harness. An Improper Access Control vulnerability can expose the TOPHATAPPTOKEN token stored in /.tophatrc through use of a malicious Tophat URL controlled by the attacker. The vulnerability allows Tophat to send this token to the attacker's server without...
CVE-2024-45036
CVE-2024-45036 affects Shopify/Tophat, an open source mobile application testing harness. Affected versions are prior to 1.10.0 and involve an improper access control flaw that can expose the TOPHAT_APP_TOKEN stored in ~/.tophatrc when a malicious Tophat URL is used, enabling the attacker to send...
PT-2024-31386 · Tophat · Tophat
Name of the Vulnerable Software and Affected Versions: Tophat versions prior to 1.10.0 Description: The issue is related to an Improper Access Control vulnerability that can expose the TOPHAT APP TOKEN token stored in /.tophatrc through the use of a malicious Tophat URL controlled by the attacker...
Tophat 安全漏洞
Tophat is an open source testing tool from Shopify. A security vulnerability exists in Tophat versions prior to 1.10.0 that stems from improper protection of the TOPHATAPPTOKEN token, which can be obtained by an unauthenticated attacker via a maliciously constructed Tophat URL to gain access to...
PT-2024-10235 · Versa · Versa Director
Name of the Vulnerable Software and Affected Versions: Versa Director affected versions not specified Description: The issue is related to the REST API in Versa Director, which is used for orchestration and management. Certain APIs, such as the login screen, banner display, and device registratio...
CVE-2024-42531
creationtimestamp| type| source ---|---|--- 2024-08-23 19:38:45+00:00| seen| https://t.me/cvedetector/4023 2024-08-29 09:08:07+00:00| published-proof-of-concept| https://t.me/HackingInsights/11495...
CVE-2024-31842
An issue was discovered in Italtel Embrace 1.6.4. The web application inserts the access token of an authenticated user inside GET requests. The query string for the URL could be saved in the browser's history, passed through Referers to other web sites, stored in web logs, or otherwise recorded ...