PT-2024-18908

Name of the Vulnerable Software and Affected Versions github.com/greenpau/caddy-security affected versions not specified Description The issue is related to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid ev...

The vulnerability of the “Allow Subdomains” configuration in the OAuth2 authentication platform allows a hacker to bypass security restrictions and redirect users to any arbitrary URL address.

The vulnerability of the “Allow Subdomains” configuration in the OAuth2 authentication platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and redirect users to any arbitrary URL address...

CVE-2023-31580

light-oauth2 before version 2.1.27 obtains the public key without any verification. This could allow attackers to authenticate to the application with a crafted JWT token...

Nextcloud Security Breach

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Server. An attacker could use this vulnerability to brute-force break the client secrets of a configured OAuth...

PT-2023-3904 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.27.0 Envoy versions prior to 1.26.4 Envoy versions prior to 1.25.9 Envoy versions prior to 1.24.10 Envoy versions prior to 1.23.12 Description: The issue is related to a lack of output encoding or escaping mechanism ...

The vulnerabilities of the APIkit components, the HTTP connector, and the OAuth2 Provider integrated into the API Gateway environment of the Mule Runtime, allow attackers to gain unauthorized access to protected information.

The vulnerabilities of the APIkit components, the HTTP connector, and the OAuth2 Provider integrated into the API Gateway environment of Mule Runtime Mule are related to errors in processing the relative path to the restricted directory. Exploiting these vulnerabilities can allow an attacker to...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

SUSE CVE-2018-1082

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site...

SUSE CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

SUSE CVE-2023-23944

Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user...

GHSA-32VJ-V39G-JH23 spring-security-oauth2-client vulnerable to Privilege Escalation

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

fhir-works-on-aws-authz-smart 信息泄露漏洞

fhir-works-on-aws-authz-smart is a SMART implementation on FHIR v1.0.0 of the FHIR Works on AWS framework open-sourced by Amazon Web Services Labs. Designed to leverage the OAuth2/OIDC authorization server to authorize requests. An information disclosure vulnerability exists in...

curl: OAUTH2 bearer bypass in connection re-use

A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or by a malicious...

curl: OAUTH2 bearer bypass in connection re-use

A vulnerability was found in curl. This security flaw allows reusing OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials set for this transfer. This issue leads to an authentication bypass, either by mistake or by a malicious...

CLSA-2022-1655317708 Fix CVE(s): CVE-2022-22576

SECURITY UPDATE: Reusing OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials - debian/patches/CVE-2022-22576.patch: Check additional SASL parameters for connection reuse - CVE-2022-22576...

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S) IMAP(S) POP3(S) and LDAP(S) (openldap only).

...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

GHSA-FPCR-4RR5-HPCP Mattermost Server vulnerable to user account takeover when Single Sign-On OAuth2 is used

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL allows a perpetrator to bypass the authentication process and gain unauthorized access to protected information.

The vulnerability of the OAUTH2 protocol implementation in the command-line tool cURL relates to the repeated use of the same connection with the same credentials. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and gain unauthorized access to protected...

ROS-20220516-30

Vulnerability in the cURL command line utility is related to OAUTH2 connection reuse errors for SASL-enabled protocols such as SMPTPS, IMAPS, POP3S, and LDAPS openldap only. Exploitation of the vulnerability could allow an attacker acting remotely to reuse the OAUTH2 authenticated connections...