CVE-2017-16758

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

CVE-2017-16758

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

PT-2017-14540

Name of the Vulnerable Software and Affected Versions Ultimate Instagram Feed plugin versions prior to 1.3 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the access token parameter in the...

CVE-2017-16758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/partials/uif-access-token-display.php in the Ultimate Instagram Feed plugin before 1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "accesstoken" parameter...

Ultimate Instagram Feed <= 1.3 - Authenticated Cross-Site Scripting (XSS)

Author: OmarK The vulnerability lies in the "accesstoken" parameter and can cause reflected XSS vulnerability. The issue is on the file ultimate-instagram-feed/admin/partials/uif-access-token-display.php line 19: the vulnerable code is the following: echo $GET'accesstoken'; There is an echo of th...

Unauthorized Access

loopback is vulnerable to unauthorized access. If an admin instance and a customer instance share the same user id and password, the customer instance can change the password of the admin instance using their regular access token...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

CVE-2017-12160

CVE-2017-12160 affects Keycloak-based Red Hat Single Sign-On (rh-sso7-keycloak). The flaw in the OAuth flow permits an authenticated resource to obtain an access/refresh token pair from the authentication server, enabling indefinite usage if permissions are revoked. An attacker on a already-compr...

PT-2017-12375

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw was discovered in Keycloak oauth that allows an authenticated resource to obtain an access/refresh token pair from the authentication server. This permits indefinite usage even in the...

CVE-2017-12160: Improper Authorization

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

keycloak: resource privilege extension via access token in oauth

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

keycloak: resource privilege extension via access token in oauth

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On security update

Red Hat Single Sign-On 7.1.3 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

CVE-2017-1000110: Improper Authentication

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

CVE-2017-1000110

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when...

PT-2017-10815

Name of the Vulnerable Software and Affected Versions Blue Ocean affected versions not specified Description The issue concerns the improper checking of user authentication and authorization in Blue Ocean when configuring existing GitHub organization folders. This allows users with read access to...

Razer US: CORS Misconfiguration leading to disclosure of access_token and account takeover!

The researcher discovered that the SSO endpoint for oauth2.razerzone.com, which is a web API server for our Razer ID architecture, did not properly validate the origin header of the caller. This would allow any caller to obtain a user's access token, which combined with other techniques, could...

PT-2017-6114 · D Link +1 · D-Link Dns-320 +2

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320L versions prior to 1.04b12 D-Link DNS-327L versions prior to 1.03b04 Build0119 Description: The issue allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album id an...