1917 matches found
Coinbase: XXE in OAuth2 Applications gallery profile App logo
upload svg photo XML based as App logo contain XML payload renamed to .jpg server start execute this XML payload or just watch this video "https://www.dropbox.com/s/wkba6f0wrax0wr8/xxe.mp4?dl=0" the same vulnerability was in https://www.coinbase.com/careers and reported by...
Spring Social Java Library Social Authentication Vulnerability
A nasty cross-site request forgery vulnerability was patched Thursday in the Spring Social core library, one of the most pervasive Java application libraries. Spring Social facilitates social authentication between applications and online services, and the vulnerability allowed attackers to bypas...
Amazon Linux: Security Advisory (ALAS-2014-425)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
RHEL 6 : Red Hat Satellite 6.1.1 on RHEL 6 (Important) (RHSA-2015:1592)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1592 advisory. Red Hat Product Security has rated this update as having an important security impact. Common Vulnerability Scoring System CVSS base scores,...
RHEL 7 : Red Hat Satellite 6.1.1 on RHEL 7 (Important) (RHSA-2015:1591)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1591 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring...
python-oauth2: Uses poor PRNG in nonce
It was found that python-oauth2 did not properly generate random values for use in nonces. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...
Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 6
Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having an important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE...
Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 7
Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 7. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning...
python-oauth2: _check_signature() ignores the nonce value when validating signed urls
It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...
zf-oauth2 security bypass vulnerability
OAuth is an open web standard for authorization that is widely used around the world and is currently in version 2.0. A security bypass vulnerability exists in zf-oauth2, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations...
Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass
OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...
WordPress plugin Google Analytics by Yoast stored XSS vulnerability-vulnerability warning-the black bar safety net
WordPress famous plugin Google Analytics by Yoast plug-in exposed storage-typeXSSvulnerability that can allow unauthorized attackers in the WordPress admin panel to store any HTML code, including JavaScript. The administrator to view the plugin Settings panel is a JavaScript will be triggered, do...
QIWI: [qiwi.com] /oauth/confirm.action XSS
Hey hi, I have found a XSS in oauth2 vulnerable link: https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe steps to reproduce: 1 open the following link https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe 2 click...
Fedora 21 : python-oauth2-1.5.211-8.fc21 (2014-12483)
Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...
[SECURITY] Fedora 21 Update: python-oauth2-1.5.211-8.fc21
Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...
Fedora 20 : python-oauth2-1.5.211-8.fc20 (2014-12475)
Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...
Fedora Update for python-oauth2 FEDORA-2014-12536
Check the version of python-oauth2 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868428";...
Fedora Update for python-oauth2 FEDORA-2014-12475
Check the version of python-oauth2 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868433";...
Fedora 19 : python-oauth2-1.5.211-8.fc19 (2014-12536)
Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...
[SECURITY] Fedora 20 Update: python-oauth2-1.5.211-8.fc20
Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...