CVE-2020-7948: Undefined Security Weakness

An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference...

WordPress Auth0 wp-auth0 Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Auth0 wp-auth0. The vulnerability stems from the WEB application...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

Design/Logic Flaw

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

CVE-2019-20173 pertains to the WordPress Auth0 wp-auth0 plugin (versions 3.11.x up to before 3.11.3). The issue is a cross-site scripting (XSS) vulnerability triggered through a wle parameter processed in wp-login.php, allowing unauthenticated or user-interaction-requiring execution of script in ...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20173: Improper Neutralization of Input During Web Page Generation

The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

Cross site scripting

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock prior to version 11.21.0 is vulnerable to cross-site scripting when additionalSignUpFields uses an untrusted placeholder. The issue is triggered by untrusted placeholder content being rendered in the Sign Up dialog, enabling XSS. Red Hat and OSV records corroborate the same description...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

Cross-Site Scripting (XSS)

Auth0-Lock is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary and execute arbitrary Javascript into a user's browser via the placeholder property. Customers using the additionalSignUpFields customization option are affected...

CVE-2019-20174: Improper Neutralization of Input During Web Page Generation

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

@brudi-toolbox/id (>=1.4.5-next.1, <=1.11.4-next.7), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2019-20174 via auth0-lock (>=11.0.1, <=11.20.4)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.17.1 Source cves: CVE-2019-20174 Source advisory: OSV:GHSA-W2PF-G6R8-PG22...

GHSA-W2PF-G6R8-PG22 auth0-lock vulnerable to XSS via unsanitized placeholder property

Overview Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to the sign-up dialog that are passing a placeholder property obtained from an untrusted source e.g. a query paramet...

auth0-lock vulnerable to XSS via unsanitized placeholder property

Overview Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to the sign-up dialog that are passing a placeholder property obtained from an untrusted source e.g. a query paramet...