893 matches found
Design/Logic Flaw
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263
The CVE-2020-5263 entry concerns the Auth0.js (NPM package auth0-js) library. Affected versions are greater than 8.0.0 and before 9.12.3, where an authentication error returns an error object that may contain the user’s original request, potentially exposing the plaintext password if logged or ex...
CVE-2020-5263 Information disclosure through error object
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
CVE-2020-5263: Insufficiently Protected Credentials
auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...
WordPress Auth0 Cross-Site Request Forgery Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Auth0 versions prior to 4.0.0, which stems from...
WordPress Auth0 Insecure Direct Object Reference Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in WordPress Auth0 versions prior to 4.0.0. The vulnerability can be exploited...
WordPress CSV Injection Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An injection vulnerability exists in WordPress Auth0 prior to version 4.0.0, which results from the program no...
WordPress Auth0 Cross-Site Scripting Vulnerability (CNVD-2020-33761)
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Auth0 versions prior to 4.0.0. The vulnerability stem...
CVE-2020-5391
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
CVE-2020-5392
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...
CVE-2020-7948
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference...
CVE-2020-5391
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
CVE-2020-6753
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392...
CVE-2020-5392
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...
CVE-2020-7948
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference...
CVE-2020-5391
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
Input validation
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...