CVE-2023-6813

CVE-2023-6813 affects the Login by Auth0 plugin for WordPress. All versions up to 4.6.0 are vulnerable to Reflected XSS via the wle parameter due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts in pages executed after user actions (e.g....

WordPress Login by Auth0 plugin <= 4.6.0 - Reflected Cross-Site Scripting via wle vulnerability

Reflected Cross-Site Scripting via wle vulnerability discovered by Krzysztof Zając in WordPress Plugin Login by Auth0 versions = 4.6.0...

WordPress Login by Auth0 Plugin <= 4.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Login by Auth0 Type Plugin Vulnerable versions = 4.6.0 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6813 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 700ddc0d68f5 Credits Krzysztof Zając...

Malicious code in auth0-authz-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc031877d6efc19470df3d757e067cb9fd38974fd69be4140e854f2ca69840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7093 Malicious code in auth0-authz-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc031877d6efc19470df3d757e067cb9fd38974fd69be4140e854f2ca69840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0-dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7094 Malicious code in auth0-dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0-mailchimp-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2f2ab30602da138b3668767294a045502dabcc11b0db0aa9c89dd18de4ab0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7087 Malicious code in auth0-mailchimp-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2f2ab30602da138b3668767294a045502dabcc11b0db0aa9c89dd18de4ab0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0.net (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1 On npm install, package.json's preinstall and preupdate/test hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun ...

MAL-2024-1783 Malicious code in auth0.net (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1 On npm install, package.json's preinstall and preupdate/test hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun ...

Okta Discloses Broader Impact Linked to October 2023 Support System Breach

Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system. "The threat actor downloaded the names and email addresses of all Okta customer support system users," the company sa...

Leaving Authentication Credentials in Public Code

Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code: Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000...

Security Bulletin: Multiple vulnerabilities in jsonwebtoken package affects Data Replication on Cloud Pak for Data

Summary Multiple vulnerabilities in jsonwebtoken package used in Data Replication on Cloud Pak for Data was addressed. Vulnerability Details CVEID:CVE-2022-23541 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacker to bypass security restrictions, caused by an insecure...

MAL-2023-1508 Malicious code in auth0-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4267198f7d6d37ea13e1bdc92116960ceef69ae0ac639131ebf85d223180dd22 The OpenSSF Package Analysis project identified 'auth0-playground' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in auth0-playground (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4267198f7d6d37ea13e1bdc92116960ceef69ae0ac639131ebf85d223180dd22 The OpenSSF Package Analysis project identified 'auth0-playground' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]

Summary Node.js module Auth0 jsonwebtoken is used by IBM App Connect Enterprise Certified Container for generating, parsing and verifying JWTs. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...

Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities

Summary IBM Security Verify Information Queue ISIQ v10.0.5 has remediated vulnerabilities in the third-party libraries that it uses. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a local authenticated attacker to obtain sensitive information, caused by not...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken with details below. Vulnerability Details CVEID:CVE-2022-23540 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacker to bypass securit...