CVE-2019-3876

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction ...

Security Bulletin: Reflected XSS in IBM Worklight OAuth Server Web Api

Summary A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework. The vulnerable parameter is "scope", if you set as value a "realm"; not defined in authenticationConfig.xml you get an HTTP 403 Forbidden response...

IBM Worklight / MobileFirst Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 a3/4 Reflected Cross-Site Scripting in IBM Worklight OAuth Server Web Api a1/2 ======== a3/4 Table of Contents a1/2 ========================================= 0. Overview 1. Detailed Description 2. Proof Of Concept 3. Solution 4. Disclosure Timeline ...

Jasig CAS 4.0.1 Cross Site Scripting

Jasig CAS server version 4.0.1 is prone to xss vulnerabilities Timeline: 20.02.2015 - Vendor notified 11.05.2015 - Patches released 21.09.2015 - Bugtraq disclosure Vulnerable version: 4.0.1 Fixed version: 4.0.2 Vulnerabilities details: 1 XSS in OpenID server Obtain method: Paste thi url...

WordPress WP OAuth Server Plugin Predictable Random Number Generation Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . WP OAuth Server is one of the plug-ins used to create and manage the OAuth2.0 server . A predictable random number...

WP OAuth Server <= 3.1.4 - Insecure Pseudor&om Number Generation

The WP OAuth Server OAuth Authentication WordPress plugin was affected by an Insecure Pseudor Number Generation security vulnerability...