au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778https://vulners.com/mend/M...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +662 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=2.0.16.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +286 more potentially affected by CVE-2019-3778 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.4.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =1.0.0, =1.0.6, =1.0.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2019-3778 Source advisory: MEND:CVE-2019-3778...

Open Redirection

spring-security-oauth2 is vulnerable to open redirection. A lack of validation on the redirecturi parameter allows an attacker to manipulate the redirect URI by sending a malicious request to the authorization endpoint using the authorization code grant type and cause the authorization server to...

Open Redirector in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.5 , and 2.2 prior to 2.2.4 , and 2.1 prior to 2.1.4 , and 2.0 prior to 2.0.17 , and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request t...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

Cross site scripting

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 is affected by a Reflected XSS vulnerability in the oauth2/fallbacks/error error_hint parameter. The issue allows injection of arbitrary script via that parameter. No exploitation status or mitigations are provided in the excerpt; refer to the CVE entry and li...

CVE-2019-8400: Improper Neutralization of Input During Web Page Generation

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

Nonce Values Unchecked

python-oauth2 is vulnerable to replay attacks. This vulnerability is caused in the Server.verifyrequest function where it does not check the nonce value, allowing remote attackers to perform replay attacks through a signed URL...

Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

GHSA-4RM3-4MQ4-MFWR Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

CVE-2018-20595

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

CVE-2018-20595

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

Cross site request forgery (csrf)

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

CVE-2018-20595

Summary: The CSRF vulnerability CVE-2018-20595 affects hsweb 3.0.4 in the file web/authorization/oauth2/controller/OAuth2ClientController.java. The issue arises because the request’s state parameter is not compared against the session’s state parameter after successful authentication, enabling po...

CVE-2018-20595

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...