CVE-2018-1000173

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

CVE-2018-1000173

CVE-2018-1000173 describes a session-fixation vulnerability in Jenkins Google Login Plugin (1.3 and older) via GoogleOAuth2SecurityRealm.java, allowing an attacker to impersonate another user if they can control the pre-authentication session. Several connected sources corroborate the issue and i...

CVE-2018-1000174

The CVE-2018-1000174 issue affects Jenkins Google Login Plugin ≤ 1.3, in GoogleOAuth2SecurityRealm.java, enabling an open redirect to an arbitrary URL after login. The root cause is improper redirection handling, leading to potential user redirection to attacker-controlled sites. SUSE/GHSA/OSV re...

CVE-2018-1000174: URL Redirection to Untrusted Site

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login...

CVE-2018-1000173: Session Fixation

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session...

PT-2018-9343

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older Description A session fixaction vulnerability exists in the GoogleOAuth2SecurityRealm.java file, allowing unauthorized attackers to impersonate another user if they can control the...

PT-2018-9344

Name of the Vulnerable Software and Affected Versions Jenkins Google Login Plugin versions 1.3 and older Description An open redirect issue exists in the GoogleOAuth2SecurityRealm.java file, allowing attackers to redirect users to an arbitrary URL after a successful login. Recommendations For...

Session fixation vulnerability in Google Login Plugin

Google Login Plugin did not invalidate the previous session and create a new one upon successful login, allowing attackers able to control or obtain another user's pre-login session ID to impersonate them. Google Login Plugin now invalidates the previous session during login, and creates a new on...

Open redirect vulnerability in Google Login Plugin

Google Login Plugin redirected users to an arbitrary URL specified as a query parameter after successful login, enabling phishing attacks. Google Login Plugin now only performs redirects to relative URLs...

Cross site request forgery (csrf)

CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL...

CVE-2017-8875

CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL...

WordPress Clean Login Plugin CSRF Vulnerability

WordPress "Clean Login" is a front-end login and registration plugin. WordPress Clean Login plugin suffers from a CSRF vulnerability, which can be exploited by remote attackers to change wordpress login redirect url to other malicious addresses...

CVE-2014-4576

Cross-site scripting XSS vulnerability in services/diagnostics.php in the WordPress Social Login plugin 2.0.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the xhrurl parameter...