Authorization

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

CVE-2018-15758

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

CVE-2018-15758

Spring Security OAuth vulnerability CVE-2018-15758 affects multiple branches: 2.3.x before 2.3.4, 2.2.x before 2.2.3, 2.1.x before 2.1.3, and 2.0.x before 2.0.16 (older unsupported versions). The issue, described across connected sources, allows a malicious user to craft a request to a custom app...

CVE-2018-15758 Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Unisys Stealth Solution Stealth Authorization Server Information Disclosure Vulnerability

Unisys Stealth Solution is a software-based solution for preventing cyber threats and protecting assets from Unisys, Inc. Stealth Authorization Server is one of the authentication servers. A security vulnerability exists in the Stealth Authorization Server in Unisys Stealth Solution prior to...

CVE-2018-7534

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory...

CVE-2018-7534

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory...

CVE-2018-7534

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory...

CVE-2018-7534

The CVE-2018-7534 issue affects Unisys Stealth Solution’s Stealth Authorization Server prior to version 3.3.017.0, where an AES encryption key may remain in memory due to failures in memory encryption/garbage collection. This could allow an attacker with local access to obtain the key and perform...

Shining a Light on OAuth Abuse with PwnAuth

Introduction Spear phishing attacks are seen as one of the biggest cyber threats to an organization. It only takes one employee to enter their credentials or run some malware for an entire organization to become compromised. As such, companies devote significant resources to preventing credential...

Internet Bug Bounty: open redirect in rfc6749

OAuth Providers servers that strictly follow rfc6749 are vulnerable to open redirect. Let me explain, reading 0 If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource...

DoS против Cisco PIX (aaa authentication flood)

При слишком большом числе одновременных запросов на авторизацию сервер перестает функционировать...