Etherty Token Number Error Vulnerability

Etherty Token ETY is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in ETY. An attacker can exploit the vulnerability to retrieve a generated token...

CVE-2014-1423: Insufficiently Protected Credentials

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oau...

Logic Flaw Vulnerability in Geth/Parity RPC API for Ethernet Nodes

Geth/Parity is an Ether node agent. The vulnerability stems from an Ethernet node Geth/Parity RPC API authentication flaw, where a malicious call to ethsendTransaction steals tokens. An attacker could use this vulnerability to steal tokens from others...

CVE-2020-1631 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

CVE-2020-1631

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

UBUNTU-CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...

Nagios Log Server Incorrect Access Control Vulnerability

Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. An incorrect access control vulnerability exists in Nagios Log Server 2.1.3. An attacker...

Rockstar Games: Referer Leakge in language changer may lead to FB token theft.

In this report, the researcher identified a CSRF vulnerability in the language changing function on https://www.rockstargames.com/GTAOnline/ that could be combined with other vulnerabilities to result in sensitive token theft such as Oauth tokens. This vulnerability would be triggered when changi...

Cross site scripting

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

CVE-2020-6804

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

CVE-2020-6804

CVE-2020-6804 is a reflected XSS in Mozilla WebThings Gateway. The vulnerability allows crafted URLs to steal a user’s authentication token via the gateway interface. When paired with CVE-2020-6803 (open redirect on the gateway login page), an attacker could fully compromise the system. The provi...

CVE-2020-6804: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

Rockstar Games: Open redirect in https://www.rockstargames.com/GTAOnline/restricted-content/agegate/form may lead to Facebook OAuth token theft

In this report, the researcher identified an Open Redirect vulnerability in the age-gate code on the GTA Online sub-site. This vulnerability could also potentially have caused sensitive tokens to leak via the Referer header if it were exploited under specific circumstances. The Open Redirect was...

Rockstar Games: Referer Leakage Vulnerability in socialclub.rockstargames.com/crew/ leads to FB'S OAuth token theft.

In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. In this instance, an Open Redirect vulnerability was utilized to exploit the fact that the ful...

Tricky Phish Angles for Persistence, Not Passwords

Late last year saw the re-emergence of a nasty phishing tactic that allows the attacker to gain full access to a user's data stored in the cloud without actually stealing the account password. The phishing lure starts with a link that leads to the real login page for a cloud email and/or file...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

Cross site scripting

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393: Improper Neutralization of Input During Web Page Generation

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

GitLab EE Token Plaintext Storage Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is GitLab Enterprise Edition. A token explicit storage vulnerability exists in GitLab EE 8...