CVE-2018-18425

The doAirdrop function of a smart contract implementation for Primeo PEO, an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. Increasing the total...

CVE-2025-31484 conda-forge infrastructure uses a bad token for Azure's cf-staging access

conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-forge infrastructure used the wrong token for Azure's cf-staging access. This bug meant that any feedstock maintainer could upload a packa...

CVE-2024-11087

CVE-2024-11087 relates to the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon for WordPress. The vulnerability is an authentication bypass introduced by insufficient verification on the user returned by the social login token, allowing unauthenticated attackers...

Linux Distros Unpatched Vulnerability : CVE-2021-43332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentiall...

Linux Distros Unpatched Vulnerability : CVE-2019-3864

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific parameter which is used as a...

CVE-2019-15002

CVE-2019-15002 is a CSRF vulnerability affecting Atlassian Jira 7.6.4–8.1.0 where the login form does not require a CSRF token, enabling an attacker to log a user into an account without their consent. The issue is documented across multiple sources (NVD/NVD-derived entries, TALOS, and PT Securit...

CVE-2025-24896 Misskey allows token to remain valid in cookie after signing out

Misskey is an open source, federated social media platform. Starting in version 12.109.0 and prior to version 2025.2.0-alpha.0, a login token named token is stored in a cookie for authentication purposes in Bull Dashboard, but this remains undeleted even after logout is performed. The primary...

CVE-2025-24896

CVE-2025-24896 concerns Misskey, an open-source federated social platform. A login token named token is stored in a cookie for Bull Dashboard authentication and is not deleted after logout in versions up to 12.109.0 and before 2025.2.0-alpha.0, potentially exposing the token to others on public o...

CVE-2025-24805

Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted...

CVE-2020-13322

A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthorized user can create and delete deploy tokens...

CVE-2024-11015

The Sign In With Google plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.8.0. This is due to the 'authenticateuser' user function not implementing sufficient null value checks when setting the access token and user information. This makes it...

PT-2024-35153

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.8.5 authentik versions prior to 2024.10.3 Description The issue allows an attacker to obtain a token with scopes that haven't been configured in authentik when using the client credentials or device code OAuth...

CVE-2024-50634

A vulnerability in a weak JWT token in Watcharr v1.43.0 and below allows attackers to perform privilege escalation using a crafted JWT token. This vulnerability is not limited to privilege escalation but also affects all functions that require authentication...

Mastodon < 4.1.18 Multiples Vulnerabilities

According to its self-reported version number, the Mastodon application running on the remote host is prior to 4.1.18 or 4.2.x prior to 4.2.10. It is, therefore, affected by multiples vulnerabilities : - An Insufficient permission checking on multiple API endpoints - An Improper authorship check ...

Mastodon 4.2.x < 4.2.10 Multiples Vulnerabilities

According to its self-reported version number, the Mastodon application running on the remote host is prior to 4.1.18 or 4.2.x prior to 4.2.10. It is, therefore, affected by multiples vulnerabilities : - An Insufficient permission checking on multiple API endpoints - An Improper authorship check ...

RHEL 6 : openstack-keystone (RHSA-2014:0580)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0580 advisory. The OpenStack Identity service keystone authenticates and authorizes OpenStack users by keeping track of users and their permitted activities. The...

PT-2024-10765 · Opentext · Opentext Privileged Access Manager

Name of the Vulnerable Software and Affected Versions: OpenText Privileged Access Manager versions prior to 3.7.0.1 Description: A vulnerability found in OpenText Privileged Access Manager issues a token, and on successful issuance of the token, a cookie gets set that allows unrestricted access t...

Medium: krb5

Issue Overview: krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37371 Affected Packages: krb5 Note: This advisory i...

Lunary Unauthorized Access Vulnerability

lunary is lunary open source a production toolkit for LLM. lunary has an unauthorized access vulnerability , the vulnerability stems from the password recovery mechanism in the reset password token does not expire after use , an attacker can use this vulnerability by cracking the recovery token t...

PT-2023-32392 · WordPress · Export Any Wordpress Data To Xml/Csv +1

Name of the Vulnerable Software and Affected Versions: Export any WordPress data to XML/CSV WordPress plugin versions prior to 1.4.0 WP All Export Pro WordPress plugin versions prior to 1.8.6 Description: The issue allows attackers to make logged-in users perform unwanted actions, leading to remo...