CVE-2024-39906: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads t...

OwnCast remote code execution vulnerability

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

CVE-2023-46480

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

CVE-2023-46480

OwnCast v0.1.1 contains a remote code execution vulnerability exploitable via the authHost parameter in the indieauth function. Public sources (NVD/Red Hat/Veracode/GHSA) describe an in-the-wild risk with high impact, including arbitrary code execution and disclosure of sensitive information. The...

CVE-2023-46480

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

CVE-2023-46480: Server-Side Request Forgery (SSRF)

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

PT-2023-30044 · Owncast · Owncast

Name of the Vulnerable Software and Affected Versions: OwnCast version 0.1.1 Description: The issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function. Recommendations: For OwnCast version 0.1.1, consider...

CVE-2023-46480

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

OwnCast Security Breach

Owncast is an open source, self-hosted, decentralized, single-user real-time video streaming and chat server. A security vulnerability exists in OwnCast version v.0.1.1, which originated from a vulnerability that allows remote attackers to obtain sensitive information or execute arbitrary code vi...

CVE-2023-46480

An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function...

Authorization Bypass

datasetteindieauth is vulnerable to authorization bypass. The vulnerability exists because it does not check that the final me URL value returned by the authorization server belongs to the same domain as the initial value entered by the user, allowing an attacker to sign in using any IndieAuth...

Implementation trusts the "me" field returned by the authorization server without verifying it

Impact A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user. Patches Version 1.1 fixes this...

GHSA-MJCR-RQJG-RHG3 Implementation trusts the "me" field returned by the authorization server without verifying it

Impact A malicious user can sign in as a user with any IndieAuth identifier. This is because the implementation does not verify that the final "me" URL value returned by the authorization server belongs to the same domain as the initial value entered by the user. Patches Version 1.1 fixes this...

PT-2020-21408

Name of the Vulnerable Software and Affected Versions datasette-indieauth versions prior to 1.1 Description A malicious user can sign in as a user with any IndieAuth identifier due to the implementation not verifying that the final "me" URL value returned by the authorization server belongs to th...