keycloak: resource privilege extension via access token in oauth

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On security update

Red Hat Single Sign-On 7.1.3 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

Razer US: CORS Misconfiguration leading to disclosure of access_token and account takeover!

The researcher discovered that the SSO endpoint for oauth2.razerzone.com, which is a web API server for our Razer ID architecture, did not properly validate the origin header of the caller. This would allow any caller to obtain a user's access token, which combined with other techniques, could...

PT-2017-6114 · D Link +1 · D-Link Dns-320 +2

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320L versions prior to 1.04b12 D-Link DNS-327L versions prior to 1.03b04 Build0119 Description: The issue allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album id an...

Full-Access Token Leakage

github.com/minio/minio is vulnerable to full-access token leakage. The vulnerability exists because the full-access token is visible in the GET URL of a download request...

How Can I dig to a value of $ 8000 Uber vulnerability-vulnerability warning-the black bar safety net

I study Uber vulnerability has been there for some time, and this is the first time I posted about the Uber vulnerability discovery report, I hope can give you some interesting burrowing ideas. In this article, I will share with you the one I'm in the Uber system in the discovery of interesting...

CVE-2017-7512

Red Hat 3scale aka RH-3scale API Management Platform AMP before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512...

Authentication flaw

Red Hat 3scale aka RH-3scale API Management Platform AMP before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512...

CVE-2017-7512

Technical details for CVE-2017-7512 are not publicly available in the provided documents. Monitor for updates to verify affected products, scope, and fixes.

CVE-2017-7512

Red Hat 3scale aka RH-3scale API Management Platform AMP before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512...

Important: Red Hat Security Advisory: Red Hat 3scale API Management Platform 2.0.0 security update

A security update for Red Hat 3scale API Management Platform 2.0.0 is now available from the Red Hat Container Catalog. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2017-7512

It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs...

CVE-2017-7512

Red Hat 3scale aka RH-3scale API Management Platform AMP before 2.0.0 would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. NOTE: some sources have a typo in which CVE-2017-7512...

Automattic: An Automattic employee's GitHub personal access token exposed in Travis CI build logs

An employee's GitHub OAuth token was inadvertently exposed in the Travis CI build logs of an Automattic project. This token has since been revoked. Please see https://blog.travis-ci.com/2017-05-08-security-advisory for more information...

Unauthorized Change Of Password

loopback is vulnerable to unauthorized password changes. The vulnerability exists as loopback accepts a change of user password without having the user to confirm their old password, leading to an account takeover. The attack is possible as long as an attacker can perform some form of social...

HackerOne: A HackerOne employee's GitHub personal access token exposed in Travis CI build logs

Summary A HackerOne employee Reed Loden GitHub:reedloden exposed their personal access token twice in build logs of the rubysec/rubysec.github.io project: 1. 2015-12-10 2. 2016-03-01 Description The token has publicrepo scope, which means that it allows access to any public repos the owner accoun...

Instacart: Login with Google Not Authenticated on iOS App

In your iOS application, there is Login with Google. In this, you're not authenticating a user properly and it can lead to access to user accounts. Affected API: https://www.instacart.com/api/v2/users/googleloginauth In this request, these are the parameters: accesstoken, clientid,idtoken,...

GitLab: Every user can delete public deploy keys

Vulnerability details A GitLab instance can have public deploy keys that project admins can use for their project. An attacker can delete these public keys used by other users to deploy code. Impact Deleting these shared deploy keys may stop users to deploy their code. Proof of concept Make sure...