893 matches found
CVE-2020-15125
In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...
Malicious code in auth0-langchain-rag-js (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45456ae9e475bcf705080fa16f34aebd7095a7aae6490e2b0a570ecb0b36e27c Any computer that has this package installed or running should be considered...
MAL-2025-635 Malicious code in auth0-langchain-rag-js (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45456ae9e475bcf705080fa16f34aebd7095a7aae6490e2b0a570ecb0b36e27c Any computer that has this package installed or running should be considered...
MAL-2024-11818 Malicious code in auth0-lock-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc8cb7c85f580c66397adec583bbd6623eafcb98683fcf6299ca73188892009f The OpenSSF Package Analysis project identified 'auth0-lock-webpack' @ 99.99.99 npm as malicious. It is considered malicious because: - The...
Malicious code in auth0-lock-webpack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc8cb7c85f580c66397adec583bbd6623eafcb98683fcf6299ca73188892009f The OpenSSF Package Analysis project identified 'auth0-lock-webpack' @ 99.99.99 npm as malicious. It is considered malicious because: - The...
Malicious code in auth0-open-source-template (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...
MAL-2025-901 Malicious code in auth0-open-source-template (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...
Malicious code in auth0-lock-browserify (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9512 Malicious code in auth0-lock-browserify (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in rbds-frill-auth0-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 150dbdfd8f858852151c86f252e31bbb62cb7fdd4afb0babf23f9817a5a222ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-Site Scripting (XSS)
auth0/wordpress is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of the wle parameter, which could accept an arbitrary string and be improperly rendered on the login page, resulting in Cross-Site Scripting XSS...
GHSA-X6P7-44RH-M3RR Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
Impact The Auth0 WordPress plugin allows site administrators to opt-in to allowing the use of a wle parameter, which can be passed to the WordPress login page by end users. When this parameter is supplied using an expected value which is randomly generated by the plugin, by default, the end user...
Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
Impact The Auth0 WordPress plugin allows site administrators to opt-in to allowing the use of a wle parameter, which can be passed to the WordPress login page by end users. When this parameter is supplied using an expected value which is randomly generated by the plugin, by default, the end user...
GHSA-52JW-F3JQ-HHWG Duplicate Advisory: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6p7-44rh-m3rr. This link has been maintained to preserve external references. Original Description The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter...
Duplicate Advisory: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6p7-44rh-m3rr. This link has been maintained to preserve external references. Original Description The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter...
CVE-2023-6813
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-6813 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-6813 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2023-6813
CVE-2023-6813 affects the Login by Auth0 plugin for WordPress. All versions up to 4.6.0 are vulnerable to Reflected XSS via the wle parameter due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts in pages executed after user actions (e.g....
WordPress Login by Auth0 plugin <= 4.6.0 - Reflected Cross-Site Scripting via wle vulnerability
Reflected Cross-Site Scripting via wle vulnerability discovered by Krzysztof Zając in WordPress Plugin Login by Auth0 versions = 4.6.0...