Open Redirect in OAuth2 Proxy

Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user...

GHSA-5M6C-JP6F-2VCV Open Redirect in OAuth2 Proxy

Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user...

Open Redirect in OAuth2 Proxy

Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user...

Updated dovecot packages fix security vulnerabilities

Updated dovecot packages fix security vulnerabilities: The Sieve engine in Dovecot before 2.3.15 allows Uncontrolled Resource Consumption, as demonstrated by a situation with a complex regular expression for the regex extension CVE-2020-28200. Dovecot before 2.3.15 allows ../ Path Traversal. An...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

Design/Logic Flaw

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568 Dart - Publishing to third-party package repositories may expose pub.dev credentials

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 accesstoken that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend...

CVE-2021-22568

The CVE describes a vulnerability in the Dart toolchain where, during dart pub publish to a third‑party package server, the request is authenticated with an oauth2 access_token that is valid for pub.dev. An attacker obtaining these credentials can impersonate the user on pub.dev. The issue is mit...

QIWI: disclosing clients' secret keys https://stage-uapi.tochka.com:2000/

The reporter has found an open URL on a staging server leaking client IDs and client secrets used in oauth2...

JetBrains Ktor Licensing Issue Vulnerability

JetBrains Ktor is a web application framework from JetBrains Czech Republic. An authorization issue vulnerability exists in JetBrains Ktor prior to 1.6.4, which stems from improper implementation of nonce authentication in the OAuth2 authentication process. No detailed vulnerability details are...

CVE-2021-43777 Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login via OAuth incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery...

Authentication Bypass

github.com/minio/console is vulnerable to authentication bypass. When external IDP is enabled in Operator Console, operator does not perform sufficient validation checks on 'Oauth2' login flow, leading to authentication bypass...

CVE-2021-43203

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly...

CVE-2021-43203

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly...

Authentication flaw

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly...

CVE-2021-43203

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly...

CVE-2021-43203

CVE-2021-43203 affects JetBrains Ktor prior to 1.6.4, where nonce verification in the OAuth2 authentication flow is implemented improperly. This can undermine the integrity of the OAuth2 nonce check, exposing an authentication risk as described in multiple sources (Red Hat and CNVD mirrors) and s...

CVE-2021-43203

In JetBrains Ktor before 1.6.4, nonce verification during the OAuth2 authentication process is implemented improperly...

JetBrains Ktor framework 授权问题漏洞

JetBrains Ktor is a web application framework from JetBrains Czech Republic. An authorization issue vulnerability exists in JetBrains Ktor prior to 1.6.4, which stems from improper implementation of nonce authentication in the OAuth2 authentication process. No detailed vulnerability details are...