893 matches found
Cross site scripting
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392...
CVE-2020-5392
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
Cross site scripting
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-7948
The CVE-2020-7948 entry describes an insecure direct object reference in the WordPress Login by Auth0 plugin prior to version 4.0.0. Affected component: the WordPress plugin, specifically the authentication/login handling. Root cause: insecure direct object reference (no details provided). Impact...
CVE-2020-7948
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference...
CVE-2020-7947
The CVE-2020-7947 issue affects the WordPress plugin Login by Auth0 prior to 4.0.0. The vulnerability stems from data fields being populated from multiple sources without sanitization or input validation before exporting user data, enabling CSV injection via a crafted Excel document. Public refer...
CVE-2020-7947
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...
CVE-2020-5391
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
CVE-2020-5391
The CVE-2020-5391 entry concerns the WordPress Auth0 plugin (pre-4.0.0). The vulnerability is a Cross-site Request Forgery (CSRF) via the domain field, with root cause described as failing to properly validate user input. Affected software: Auth0 WordPress plugin versions before 4.0.0. Impact: co...
CVE-2020-6753
CVE-2020-6753 concerns the Login by Auth0 plugin for WordPress, affecting versions before 4.0.0. The vulnerability is a stored XSS on multiple pages, including the settings page, with the issue described as distinct from CVE-2020-5392. The connected documents corroborate the core detail: a stored...
CVE-2020-6753
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392...
CVE-2020-5392
CVE-2020-5392 concerns the WordPress Auth0 plugin prior to version 4.0.0, where a stored cross-site scripting (XSS) vulnerability is exploitable via the plugin’s settings page. The issue is documented across multiple feeds (NVD, Red Hat, OSV, CNVD, CNVD, Nessus), all describing a stored XSS vecto...
CVE-2020-5392
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-5391: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field...
Login by Auth0 < 4.0.0 - Multiple Vulnerabilities
CVE-2020-5391 - CSRF controls missing for domain field CVE-2020-5392 - Stored XSS in Settings page CVE-2020-6753 - Stored XSS in multiple pages CVE-2020-7947 - CSV injection vulnerabilities CVE-2020-7948 - Insecure direct object reference...
CVE-2020-7947: Improper Neutralization of Formula Elements in a CSV File
An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data...
CVE-2020-5392: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page...
CVE-2020-6753: Improper Neutralization of Input During Web Page Generation
The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392...