CVE-2018-1082

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site...

CVE-2018-1082: Improper Authorization

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site...

PT-2018-10126

Name of the Vulnerable Software and Affected Versions Moodle versions 3.3 through 3.3.4 Moodle versions 3.4 through 3.4.1 Description A flaw was found in the authentication process. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still...

oauth2.vidal.fr XSS vulnerability

Open Bug Bounty ID: OBB-574803 Description| Value ---|--- Affected Website:| oauth2.vidal.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Zomato: Reflected XSS on https://www.zomato.com

Hello, I found an XSS issue due to the incorrect handling of the \ character in a context, the following link works as a PoC that alerts the location of the document: https://www.zomato.com/googleOAuth2Callback?alertlocation;%3C!--&state=\ The issue exists because, given that the \ character...

secure.npr.org XSS vulnerability

Open Bug Bounty ID: OBB-440788 Description| Value ---|--- Affected Website:| secure.npr.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GHSA-FGMX-8H93-26FH omniauth-oauth2 Cross-Site Request Forgery vulnerability

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

omniauth-oauth2 Cross-Site Request Forgery vulnerability

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem prior to 1.1.1 for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

Bitly oauth2_proxy Cross-Site Request Forgery Vulnerability

Bitly oauth2proxy is a reverse proxy server that provides authentication with Google, Github and other providers. A cross-site request forgery vulnerability exists in Bitly oauth2proxy version 2.1. A remote attacker can exploit this vulnerability to perform unauthorized operations...

Razer US: Open redirect on oauth2.razerzone.com due to missing verification of redirect-uri paramether on /thirdparty endpoint

Thanks to SP1D3RS for a great report. Although there was some initial difficulty verifying this vulnerability in triage, he was very professional and helpful working with the team to make sure this was understood. This was fixed in production on 10/16. I discovered the Open Redirect on the...

Razer US: Open redirect on oauth2.razerzone.com caused by server misconfiguration when using triple slash after hostname

Another solid report form this tester, who helped us nail down the issue when it was only intermittently reproducible. We appreciate the hard work. I discovered the Open Redirect on the oauth2.razerzone.com due to improper handling of multiple/encoded slashes and dots in the URL path. POC link:...

Code injection

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

CVE-2017-3156

The CVE-2017-3156 issue concerns the OAuth2 Hawk and JOSE MAC validation in Apache CXF. The connected advisories identify a root cause: the MAC signature comparison is not performed in constant time, creating exposure to timing attacks. Affected CXF versions are before 3.0.13 and before 3.1.10 in...

CVE-2017-3156: Undefined Security Weakness

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

PT-2017-15692

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 3.0.13 Apache CXF versions 3.1.x prior to 3.1.10 Description The issue concerns the OAuth2 Hawk and JOSE MAC Validation code, which does not utilize a constant time MAC signature comparison algorithm. This could...

Fedora 26 : 1:dovecot (2017-e8b639c286)

quota: Add plugin quotamaxmailsize setting to limit the maximum individual mail size that can be saved. + imapc: Add imapcfeatures=delay-login. If set, connecting to the remote IMAP server isn't done until it's necessary. + imapc: Add imapcconnectionretrycount and imapcconnectionretryinterval...