Malicious code in oauth-eslint-event-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912e33dda74d1110c5a19a58e60ba349b4e47d20b5d79ea2ab9027ea4b4bacc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140542 Malicious code in centaurus-despina-pipe-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7412f390ed0a56288b73f2f3b4c82e88af73120b691359e975a6aca3e0cacf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143770 Malicious code in jabbah-blitz-oauth-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d945e0902b08e77257713b7316b3c50f0ce3c87d1e8804b22212a53021f2df88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149654 Malicious code in xenon-oauth-framework-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dce1782e99ecf2a9a1ac060d68897c127bf998539a101ddbcb4e03d4c4e560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147569 Malicious code in sadr-oauth-less-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd41cc24e26ec4db071c81f950a8b2f7fbb929edaceed842b3a51ef8fdfed23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12021

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-41116

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...

CVE-2025-3717

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...

CVE-2025-41116

CVE-2025-41116 affects Grafana Databricks Datasource Plugin. When Oauth passthrough is enabled and multiple users share a single Grafana instance/datasource, the wrong user identifier can be used, potentially returning data the viewer is not authorized to see. Affected versions: 1.6.0 up to, but ...

CVE-2025-41116 Incorrect oauth passthrough in Grafana Databricks Datasource

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is...

CVE-2025-12021 WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-12021

CVE-2025-12021 affects the WordPress WP-OAuth plugin, with Reflected Cross-Site Scripting via the error_description parameter in all versions up to and including 0.4.1 due to insufficient input sanitization and output escaping. This enables unauthenticated attackers to inject scripts in pages tha...

CVE-2025-12021 WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

WordPress WP-OAuth plugin <= 0.4.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin WP-OAuth versions = 0.4.1...

Grafana Databricks Datasource Plugin 安全漏洞

Grafana Databricks Datasource Plugin is an open source datasource connection plugin for Grafana. A security vulnerability exists in Grafana Databricks Datasource Plugin version 1.12.1 through versions prior to 1.12.0, which stems from the incorrect use of user identifiers when Oauth passthrough i...

WordPress plugin WP-OAuth 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-sit...

PT-2025-46272

Name of the Vulnerable Software and Affected Versions WP-OAuth plugin for WordPress versions up to and including 0.4.1 Description The WP-OAuth plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the...

CVE-2025-41116

Grafana is an open-source platform for monitoring and observability. The Grafana-Databricks-Datasource is a plugin allowing Grafana to visualize data from Databricks Enterprise Versions between 1.6.0 and 1.12.0 are vulnerable to a bug when Oauth passthrough is enabled, and multiple users are usin...

SUSE CVE-2017-18872

An issue was discovered in Mattermost Server before 4.4.3 and 4.3.3. Attackers could reconfigure an OAuth app in some cases where Mattermost is an OAuth 2.0 service provider...

SUSE CVE-2025-58073

Mattermost versions 10.11.x = 10.11.1, 10.10.x = 10.10.2, 10.5.x = 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state...