com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.m1, <=2.1.6.m2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0.rc1, <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (5.1.1.release)

org.springframework.security:spring-security-oauth2-jose MAVEN version 5.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: -...

com.microsoft.azure:azure-active-directory-b2c-spring-boot-starter (>=2.1.4.m1, <=2.1.6.m2), com.sap.cloud.security.xsuaa:spring-xsuaa (>=1.1.0.rc1, <=2.1.0) +4 more potentially affected by CVE-2018-15801 via org.springframework.security:spring-security-oauth2-jose (5.1.1.release)

org.springframework.security:spring-security-oauth2-jose MAVEN version 5.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: -...

Authorization Bypass

spring-security-oauth2-jose is vulnerable to authorization bypass attacks. The vulnerability exists during JWT issuer validation, and is only affected if the same private key for the issuer and the attacker are used when signing JWTs...

Zomato: [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider

Heyy there, I have found a xss in auth2.zomato.com Full url:https://auth2.zomato.com/oauth2/fallbacks/error?error=xss&errordescription=xss&errorhint=xss Vulnerable Parameters: All available parameters are vulnerable XSS Payload: XSS Steps To Reproduce the xss Just copy paste and load this url in...

Information Disclosure

omniauth-oauth2 is vulnerable to information disclosure. An insecure string comparison is used to verify the anti-CSRF string, allowing for an attacker to enumerate the anti-CSRF string through a timing attack...

Security update for MozillaThunderbird (important)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-15758 Source advisory: OSV:GHSA-H8W4-QV99-F7VJhttps://vulners.com...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +655 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.15.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-15758 Source advisory: GHSA-H8W4-QV99-F7VJ...

au.org.consumerdatastandards:client-cli (>=1.1.1, <=2.4.1), fm.pattern:tokamak-authorization (1.0.1) +17 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.1.0.release, <=2.1.1.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.1.0.release, =1.1.1, =1.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.9.0, =1.9.0, =1.3.0, =1.3.0, =1.3.4 and more Source cves: CVE-2018-15758 Source advisory: GHSA-H8W4-QV99-F7VJhttps://vulners.com/git...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: GHSA-H8W4-QV99-F7VJ...

am.ik.home:uaa-client (>=1.0.0, <=1.9.0), am.ik.home:uaa-integration-test (>=1.0.0, <=1.9.0) +655 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.15.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0-rc, =1.0.0, =1.0.0, =1.0.0, =3.0.0, =3.0.0.release, =3.0.1.11 and more Source cves: CVE-2018-15758 Source advisory: OSV:GHSA-H8W4-QV99-F7VJ...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: OSV:GHSA-H8W4-QV99-F...

Privilege Escalation

spring-security-oauth2 is vulnerable to privilege escalation. The library does not properly handle the AuthorizationRequest parameter state, allowing a malicious user to pass a request to an approval endpoint and modify a previous authorization request, leading to a privilege escalation...

br.com.anteros:anteros-keycloak (1.0.0), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +57 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.2.0.release, <=2.2.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.2.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0.m2, =1.0.0.m2, =3.3.2, =4.0.1 - com.ge.research.semtk:springsecuritylibrary 2.2.2 -...

br.com.anteros:anteros-security-spring (>=2.0.0, <=2.0.20), br.com.anteros:anteros-security-spring-mongo (>=1.0.0, <=1.0.5) +85 more potentially affected by CVE-2018-15758 via org.springframework.security.oauth:spring-security-oauth2 (>=2.3.0.release, <=2.3.3.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.3.0.release, =2.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.0.0.release, =3.1.0.release and more Source cves: CVE-2018-15758 Source advisory: MEND:CVE-2018-15758...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...

org.cloudfoundry:cf-gradle-plugin (>=1.0.1, <=1.0.3), org.cloudfoundry:cf-maven-plugin (>=1.0.1, <=1.0.3) +5 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=1.0.0.release, <=1.0.2.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =1.0.0.release, =1.0.1, =1.0.1, =1.0.1, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.22 Source cves: CVE-2016-4977 Source advisory: GHSA-7Q9C-H23X-65FQ...

cn.bestwu:api-sign (>=1.0.0, <=1.0.1), cn.bestwu:security-oauth2-authorizationserver (1.0.0) +184 more potentially affected by CVE-2016-4977 via org.springframework.security.oauth:spring-security-oauth2 (>=2.0.0.release, <=2.0.9.release)

org.springframework.security.oauth:spring-security-oauth2 MAVEN version =2.0.0.release, =1.0.0, =1.0.0, =1.31.1, =3.1.1, =1.0.0.release, =0.1, =5.2.2, =1.2.0, =3.1.1, =0.1, =1.0.1.release, =1.0, =1.2.3 and more Source cves: CVE-2016-4977 Source advisory: OSV:GHSA-7Q9C-H23X-65FQ...