CVE-2020-5233

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...

CVE-2020-11053

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

FreeBSD : oauth2-proxy -- Non-linear parsing of case-insensitive content (258a58a9-6583-4808-986b-e785c27b0a18)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 258a58a9-6583-4808-986b-e785c27b0a18 advisory. Golang reports: This update include security fixes: Tenable has extracted the preceding description blo...

oauth2-proxy -- Non-linear parsing of case-insensitive content

Golang reports: This update include security fixes: CVE-2024-45338: Non-linear parsing of case-insensitive content...

FreeBSD : oauth2-proxy -- multiple vulnerabilities (dbe8c5bd-8d3f-11ef-8d2e-a04a5edf46d9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the dbe8c5bd-8d3f-11ef-8d2e-a04a5edf46d9 advisory. The oauth2-proxy project reports: Vulnerabilities have been addressed: Tenable has extracted t...

oauth2-proxy -- multiple vulnerabilities

The oauth2-proxy project reports: Vulnerabilities have been addressed: CVE-2024-24786 CVE-2024-24791 CVE-2024-24790 CVE-2024-24784 CVE-2024-28180 CVE-2023-45288...

GO-2022-0790 Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy in github.com/oauth2-proxy/oauth2-proxy

Subdomain checking of whitelisted domains could allow unintended redirects in oauth2-proxy in github.com/oauth2-proxy/oauth2-proxy...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: ghaudit, wireguard-go, flux-kustomize-controller, gosu, aws-efs-csi-driver, dgraph, dex-k8s-authenticator, gobump, k9s, kubernetes-csi-livenessprobe-fips, render-template, cilium-fips, gops, timestamp-authority-fips, docker-compose, cert-manager-webhook-pdns-fips,...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, melange, bank-vaults, flux-source-controller, frp, gitsign, dex, step-ca, timestamp-authority, kubernetes-dashboard, rabbitmq-messaging-topology-operator, terragrunt, sops, temporal, slsa-verifier, falcoctl, vexctl, aactl, weaviate, skopeo, cosign,...

BIT-OAUTH2-PROXY-2020-11053 Open Redirect in OAuth2 Proxy

In OAuth2 Proxy before 5.1.1, there is an open redirect vulnerability. Users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is check...

BIT-OAUTH2-PROXY-2020-4037 Open Redirect in OAuth2 Proxy

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked with...

BIT-OAUTH2-PROXY-2020-5233 Open Redirect in OAuth2 Proxy

OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...

BIT-OAUTH2-PROXY-2021-21291 Subdomain checking of whitelisted domains could allow unintended redirects

OAuth2 Proxy is an open-source reverse proxy and static file server that provides authentication using Providers Google, GitHub, and others to validate accounts by email, domain or group. In OAuth2 Proxy before version 7.0.0, for users that use the whitelist domain feature, a domain that ended in...

BIT-OAUTH2-PROXY-2021-21411 Incorrect authorization in OAuth2-Proxy

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, ctop, dex, supercronic, kubernetes-dashboard-fips, kiam, crossplane-provider-aws-rds, falcosidekick, metallb, actions-runner-controller, crossplane-provider-aws-memorydb, buf, capslock, spire-server, aws-load-balancer-controller-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, src, kubeflow, buildkitd, prometheus-blackbox-exporter, dgraph, kubescape, kubevela, terraform-provider-sendgrid, cortex, scorecard, k3d, up, slsa-verifier, aactl...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, volume-modifier-for-k8s-fips, terraform-provider-sendgrid-fips, dgraph, prometheus-blackbox-exporter, up, kubernetes-csi-livenessprobe-fips, timestamp-authority-fips, cortex, k3d, kubescape, dynamic-localpv-provisioner-fips, buildkitd...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: wireguard-go, flux-kustomize-controller, aws-efs-csi-driver, dgraph, dex-k8s-authenticator, kubernetes-csi-livenessprobe-fips, apko, vault-k8s-fips, dex, dynamic-localpv-provisioner-fips, caddy, kubernetes-ingress-defaultbackend, flux-helm-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: flux-source-controller, prometheus-adapter, buildkitd, pulumi-kubernetes-operator, pulumi-language-yaml, kubewatch, slsa-verifier, metrics-server, weaviate, gobuster, cosign, newrelic-infrastructure-agent, cortex, dgraph, nri-prometheus, pulumi-language-java,...

Open Redirect in OAuth2 Proxy

Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user...