PT-2022-30986

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.18.3 Description The issue concerns a configuration problem with the CTS pin for Bluetooth on the sc7280-idp, which could potentially lead to security vulnerabilities. The actual impact and attack plausibility...

PT-2022-31308

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.14 Description The issue concerns a configuration problem with the CTS pin for Bluetooth on the sc7280-idp, which could potentially lead to security vulnerabilities. The actual impact and likelihood of an...

CVE-2022-1010

The Login using WordPress Users WP as SAML IDP WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in...

CVE-2022-1010

CVE-2022-1010 affects the WordPress plugin “Login using WordPress Users” (WP as SAML IDP) for versions prior to 1.13.4. The vulnerability arises because the plugin does not sanitize and escape several settings, which could allow stored Cross-Site Scripting (XSS) by high-privilege users (e.g., adm...

CVE-2022-1010: Improper Neutralization of Input During Web Page Generation

The Login using WordPress Users WP as SAML IDP WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in...

PT-2022-13591

Name of the Vulnerable Software and Affected Versions Login using WordPress Users WP as SAML IDP versions prior to 1.13.4 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is disallowed, for exampl...

Grafana -- OAuth Account Takeover

Grafana Labs reports: It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions...

Malicious code in eks-auto-create-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abe5220ea6202484d070bbe62ba66ccb40f7d0b230bcfb2a4208d4aec4877ac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2682 Malicious code in eks-auto-create-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abe5220ea6202484d070bbe62ba66ccb40f7d0b230bcfb2a4208d4aec4877ac7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idp-shared-node-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 924985792a90f0e9ebc02fb735718e78effffb1d34a5862e84d55ba9189fbeab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3778 Malicious code in idp-shared-node-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 924985792a90f0e9ebc02fb735718e78effffb1d34a5862e84d55ba9189fbeab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idp-ssr-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08090d29306b03b2059991a752dd09fa1b545e62a4a9a6add93d38c61bf49fc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idp-core-upperfunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1373820d7d831ddfeff6c51bfa444e10ffc7bfb1fd2a33bb6bf429a9b30ee96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in idp-test-test-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9493488bd24ee8204cae38eceeffa4146c22c5a34abd269163d3eaadf420583d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3779 Malicious code in idp-ssr-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08090d29306b03b2059991a752dd09fa1b545e62a4a9a6add93d38c61bf49fc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3777 Malicious code in idp-core-upperfunnel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1373820d7d831ddfeff6c51bfa444e10ffc7bfb1fd2a33bb6bf429a9b30ee96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3780 Malicious code in idp-test-test-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9493488bd24ee8204cae38eceeffa4146c22c5a34abd269163d3eaadf420583d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorization

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

PYSEC-2022-206

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Background CILogon is a federated auth provider that allows users to authenticate themselves via a number of Identity Providers IdP, focused primarily on educational and research institutions such as Universities. More traditional and open IdPs such as GitHub, ORCID, Google, Microsoft, etc are al...