CVE-2020-5425

Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Samba update (USN-4559-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4559-1 advisory. Tom Tervoort discovered that the Netlogon protocol implemented by Samba incorrectly handled the authentication scheme. A remote attacker...

PT-2020-21560

Name of the Vulnerable Software and Affected Versions fast-requests versions affected versions not specified Description The issue concerns malware embedded in the software, which uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they ha...

PT-2020-21075

Name of the Vulnerable Software and Affected Versions discord debug log affected versions not specified Description The issue concerns obfuscated malware within discord debug log that uploads Discord user tokens to a remote server, potentially allowing attackers to make unauthorized purchases on...

CVE-2020-5409: URL Redirection to Untrusted Site

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a user to click on a link using the OAuth redirect link with an untrusted website and gain access to that user's access token in Concourse...

Etherty Token Number Error Vulnerability

Etherty Token ETY is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in ETY. An attacker can exploit the vulnerability to retrieve a generated token...

Spadeico Digital Error Vulnerability

Spadeico is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in Spadeico. An attacker can exploit the vulnerability to retrieve generated tokens...

SP8DE PreSale Token Number Error Vulnerability

SP8DE PreSale Token DSPX is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'mint' function in DSPX. An attacker can exploit the vulnerability to retrieve a generated token...

CVE-2014-1423: Insufficiently Protected Credentials

signond before 8.57+15.04.20141127.1-0ubuntu1, as used in Ubuntu Touch, did not properly restrict applications from querying oath tokens due to incorrect checks and the missing installation of the signon-apparmor-extension. An attacker could use this create a malicious click app that collects oau...

Logic Flaw Vulnerability in Geth/Parity RPC API for Ethernet Nodes

Geth/Parity is an Ether node agent. The vulnerability stems from an Ethernet node Geth/Parity RPC API authentication flaw, where a malicious call to ethsendTransaction steals tokens. An attacker could use this vulnerability to steal tokens from others...

CVE-2020-1631 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

CVE-2020-1631

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

UBUNTU-CVE-2020-1772

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Tokens, generated by users which already requested new passwords. This issue affects: OTRS Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15...

Nagios Log Server Incorrect Access Control Vulnerability

Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. An incorrect access control vulnerability exists in Nagios Log Server 2.1.3. An attacker...

Rockstar Games: Referer Leakge in language changer may lead to FB token theft.

In this report, the researcher identified a CSRF vulnerability in the language changing function on https://www.rockstargames.com/GTAOnline/ that could be combined with other vulnerabilities to result in sensitive token theft such as Oauth tokens. This vulnerability would be triggered when changi...

CVE-2020-6804

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

Cross site scripting

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

CVE-2020-6804

CVE-2020-6804 is a reflected XSS in Mozilla WebThings Gateway. The vulnerability allows crafted URLs to steal a user’s authentication token via the gateway interface. When paired with CVE-2020-6803 (open redirect on the gateway login page), an attacker could fully compromise the system. The provi...

CVE-2020-6804: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability exists within the gateway, allowing an attacker to craft a specialized URL which could steal the user's authentication token. When combined with CVE-2020-6803, an attacker could fully compromise the system...

Rockstar Games: Open redirect in https://www.rockstargames.com/GTAOnline/restricted-content/agegate/form may lead to Facebook OAuth token theft

In this report, the researcher identified an Open Redirect vulnerability in the age-gate code on the GTA Online sub-site. This vulnerability could also potentially have caused sensitive tokens to leak via the Referer header if it were exploited under specific circumstances. The Open Redirect was...