1919 matches found
OPENSUSE-SU-2019:2452-1 Recommended update for MozillaThunderbird
This update for MozillaThunderbird to version 68.2.1 provides the following fixes: - Security issues fixed bsc1154738: CVE-2019-15903: Fixed a heap overflow in the expat library bsc1149429. CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB bsc1154738. CVE-2019-11758:...
Authentication Bypass
cxf-rt-rs-security-oauth2 is vulnerable to authentication bypass. The vulnerability exists as the access token services does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. An attacker with a an authorization code that is issued to...
CVE-2019-12419
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...
CVE-2015-9435
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
Design/Logic Flaw
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
CVE-2015-9435
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
CVE-2015-9435
The CVE-2015-9435 entry concerns the WordPress plugin oauth2-provider (before 3.1.5). The vulnerability arises from incorrect generation of random numbers (insecure pseudorandom number generation) in the plugin, as documented across multiple sources. Impact ranges from Partial confidentiality, in...
CVE-2015-9435: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...
LY Corporation: Reflected XSS in OAUTH2 login flow
The reporter found a reflected XSS in the OAUTH2 login flow which could have allowed potential attackers to steal credentials or hijack accounts by sending a message to the victim containing a malicious URL...
CVE-2019-15630
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow...
Directory traversal
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow...
CVE-2019-15630
CVE-2019-15630 describes a directory traversal vulnerability affecting MuleSoft products: APIkit, HTTP connector, and OAuth2 Provider components in Mule Runtime 3.x/4.x and all MuleSoft API Gateway versions released before August 1, 2019. The issue permits remote attackers to read files accessibl...
CVE-2019-15630: Improper Limitation of a Pathname to a Restricted Directory
Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow...
CVE-2019-15150
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
CVE-2019-15150
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
Design/Logic Flaw
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
CVE-2019-15150
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
CVE-2019-15150
CVE-2019-15150 affects the MediaWiki OAuth2 Client extension prior to version 0.4. The vulnerability is a CSRF issue caused by the OAuth2 state parameter not being validated in the callback function. As described in the connected sources, this can allow an attacker to perform actions on behalf of...
CVE-2019-15150: Cross-Site Request Forgery (CSRF)
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
