2128 matches found
CVE-2019-17268
The CVE-2019-17268 entry concerns the Ruby gem omniauth-weibo-oauth2.0.4.6 distributed on RubyGems.org, which contains a code-execution backdoor inserted by a third party. The vulnerability affects version 0.4.6; versions through 0.4.5, and 0.5.1 and later, are unaffected. The root cause is malic...
PT-2020-9886
Name of the Vulnerable Software and Affected Versions omniauth-weibo-oauth2 gem version 0.4.6 Description The issue concerns a code-execution backdoor inserted by a third party into the omniauth-weibo-oauth2 gem for Ruby. Recommendations For version 0.4.6, update to a version outside the affected...
CVE-2019-17268: Improper Control of Generation of Code
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...
Nextcloud Server < 12.0.8, < 13.0.3 Improper Input Vulnerability (NC-SA-2018-003)
Nextcloud Server is prone to an improper input vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
OAuth2 Proxy Open Redirect Vulnerability
OAuth2 Proxy is an OAuth2 proxy service program. OAuth2 Proxy has an input validation vulnerability that can be exploited by remote attackers to submit malicious URIs and trick users into parsing them, which can be used to perform redirection attacks, hijack sessions by obtaining sensitive...
CVE-2020-5233
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
CVE-2020-5233
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
Open redirect
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
CVE-2020-5233
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
CVE-2020-5233
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
CVE-2020-5233
CVE-2020-5233 affects the OAuth2 Proxy project (github.com/pusher/oauth2_proxy) prior to version 5.0, where an open redirect vulnerability exists in the redirect handling. The vulnerable component is the redirect/redirect URL validation path, enabling an attacker to silently harvest authenticatio...
CVE-2020-5233 Open Redirect in OAuth2 Proxy
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
PT-2020-18329 · Oauth2 Proxy · Oauth2 Proxy
Name of the Vulnerable Software and Affected Versions: oauth2 proxy versions prior to 5.0 Description: An open redirect vulnerability has been found in oauth2 proxy. This issue could allow an attacker to silently harvest authentication tokens. For example, an attacker could use a URL like...
CVE-2020-5233: URL Redirection to Untrusted Site
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0...
OPENSUSE-SU-2019:2452-1 Recommended update for MozillaThunderbird
This update for MozillaThunderbird to version 68.2.1 provides the following fixes: - Security issues fixed bsc1154738: CVE-2019-15903: Fixed a heap overflow in the expat library bsc1149429. CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB bsc1154738. CVE-2019-11758:...
Authentication Bypass
cxf-rt-rs-security-oauth2 is vulnerable to authentication bypass. The vulnerability exists as the access token services does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. An attacker with a an authorization code that is issued to...
CVE-2019-12419
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId paramet...
CVE-2015-9435
The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...