Lucene search
+L

68 matches found

CNNVD
CNNVD
added 2025/08/20 12:00 a.m.11 views

StrongDM Client 安全漏洞

StrongDM Client is a client software from StrongDM, Inc. A security vulnerability exists in StrongDM Client that stems from insufficient protection of pre-authenticated tokens, which could lead to interception and reuse of tokens...

8.5CVSS6.6AI score0.00111EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2025/07/18 12:30 p.m.13 views

Mattermost has Insufficiently Protected Credentials

Mattermost versions 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API...

3.1CVSS7.2AI score0.00175EPSS
SaveExploits0References4Affected Software2
Cvelist
Cvelist
added 2025/07/18 11:39 a.m.28 views

CVE-2025-6227 Invite token is used as part of the secure communication

Mattermost versions 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API...

2.2CVSS0.00175EPSS
SaveExploits0References1
CVE
CVE
added 2025/07/18 11:39 a.m.38 views

CVE-2025-6227

Summary: CVE-2025-6227 affects Mattermost Server versions 10.5.x (<= 10.5.7) and 9.11.x (

3.1CVSS6.7AI score0.00175EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2025/07/04 12:00 a.m.13 views

PT-2025-27847 · WordPress · Ai Engine

Name of the Vulnerable Software and Affected Versions: AI Engine plugin for WordPress version 2.8.4 Description: The issue is due to an insecure OAuth implementation, specifically the lack of validation for the redirect uri parameter during the authorization flow. This allows unauthenticated...

8CVSS6.6AI score0.0031EPSS
SaveExploits0References12
Veracode
Veracode
added 2025/05/31 6:00 p.m.8 views

Improper Certificate Validation

redshift-connector is vulnerable to Improper Certificate Validation. The vulnerability is due to improper SSL certificate validation due to the BrowserAzureOAuth2CredentialsProvider plugin skipping SSL verification for the Identity Provider, allowing token interception...

7CVSS6.7AI score0.00277EPSS
SaveExploits0References6Affected Software1
NVD
NVD
added 2025/05/27 9:15 p.m.17 views

CVE-2025-5279

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

7CVSS0.00277EPSS
SaveExploits0References3
CVE
CVE
added 2025/05/27 8:17 p.m.211 views

CVE-2025-5279

CVE-2025-5279 : The issue affects the Amazon Redshift Python Connector when configured with the BrowserAzureOAuth2CredentialsProvider plugin, where the driver skips SSL certificate validation for the Identity Provider. This can allow an attacker to intercept the token exchange and retrieve an acc...

7CVSS6.7AI score0.00277EPSS
SaveExploits0References3
OSV
OSV
added 2025/05/27 8:17 p.m.7 views

CVE-2025-5279 Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation step for the Identity Provider. An insecure connection could allow an actor to intercept the token exchange process and retrieve an access...

7CVSS5.9AI score
SaveExploits0References6
CNNVD
CNNVD
added 2025/05/27 12:00 a.m.12 views

Amazon Redshift Python Connector 安全漏洞

Amazon Redshift Python Connector is an Amazon Redshift Connector for Python by Amazon.com, Inc. A security vulnerability exists in the Amazon Redshift Python Connector that stems from the BrowserAzureOAuth2CredentialsProvider plugin skipping SSL certificate validation, which could lead to...

7CVSS6.4AI score0.00277EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2025/05/23 5:38 a.m.11 views

CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...

7.5CVSS6.8AI score0.01193EPSS
SaveExploits0References1
OSV
OSV
added 2024/12/30 4:46 p.m.17 views

GHSA-4FWJ-M62Q-PP47 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Impact A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before...

5.7CVSS5.6AI score0.00213EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2024/12/30 4:46 p.m.11 views

CVE-2024-56733 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

5.7CVSS5.5AI score0.00213EPSS
SaveExploits0References1
CVE
CVE
added 2024/12/30 4:46 p.m.66 views

CVE-2024-56733

CVE-2024-56733 affects Password Pusher (versions ≤ 1.50.3). A vulnerability allows an attacker to copy the session cookie before logout, potentially enabling session hijacking until the token expires or is cleared. Root cause centers on accessing an active session cookie (e.g., MITM, XSS, or loca...

5.7CVSS5.5AI score0.00213EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2024/05/22 12:00 a.m.13 views

PT-2024-4160

Name of the Vulnerable Software and Affected Versions Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description A vulnerability in the implementation of SAML 2.0 single sign-on SSO for...

5CVSS5.8AI score0.00333EPSS
SaveExploits0References9
OSV
OSV
added 2023/08/02 1:15 p.m.10 views

CVE-2023-26451

Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorization codes were predictable for third parties and could be used to intercept and take over the client authorization process. As a result, other users accounts...

7.5CVSS5.8AI score0.01193EPSS
SaveExploits0References4
BDU FSTEC
BDU FSTEC
added 2022/08/03 12:00 a.m.10 views

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua cameras, related to the possibility of intercepting ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera.

The vulnerability of the WS-UsernameToken authentication mechanism in Dahua IP cameras lies in the ability to intercept ONVIF requests. Exploiting this vulnerability could allow a malicious actor to gain full access to the IP camera...

7.6CVSS7.4AI score0.00943EPSS
SaveExploits1References5
BDU FSTEC
BDU FSTEC
added 2022/02/17 12:00 a.m.24 views

The vulnerability of the CGI program of the Zyxel NBG6604 switch, related to incorrect session duration, allows attackers to gain access to the device.

The vulnerability of the CGI program of the Zyxel NBG6604 switch is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to gain access to the device by intercepting the authentication token...

9.4CVSS7.7AI score0.01044EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2022/01/18 2:26 p.m.11 views

CVE-2022-22690

Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" or just "ApplicationUrl" is used whenever application code needs to build a URL pointing back to the site. For example, when a user resets their password and the application builds a password reset URL or when the...

8.6CVSS7.2AI score0.01138EPSS
SaveExploits2References2
OSV
OSV
added 2021/12/29 1:15 p.m.8 views

CVE-2021-35034

An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted...

9.1CVSS7.3AI score0.01044EPSS
SaveExploits0References1
Rows per page
Query Builder