5185 matches found
CVE-2023-22341 BIG-IP APM OAuth vulnerability
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...
CVE-2023-22341
CVE-2023-22341 affects the BIG-IP APM module. When configured with: (1) an OAuth Server referencing an OAuth Provider, (2) an OAuth profile with the Authorization Endpoint set to '/', and (3) an access profile referencing the above OAuth profile tied to an HTTPS virtual server, undisclosed reques...
CVE-2023-22341 BIG-IP APM OAuth vulnerability
On version 14.1.x before 14.1.5.3, and all versions of 13.1.x, when the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the...
K000130496: Overview of F5 vulnerabilities (February 2023)
Security Advisory Description On February 1, 2023, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities and security exposures to help determine the impact to your F5 devices. You can find the details of each issue in the associate...
K20717585: BIG-IP APM OAuth vulnerability CVE-2023-22341
Security Advisory Description When the BIG-IP APM system is configured with all the following elements, undisclosed requests may cause the Traffic Management Microkernel TMM to terminate: An OAuth Server that references an OAuth Provider An OAuth profile with the Authorization Endpoint set to '/'...
Hackers Abused Microsoft's "Verified Publisher" OAuth Apps to Breach Corporate Email Accounts
Microsoft on Tuesday said it took steps to disable fake Microsoft Partner Network MPN accounts that were used for creating malicious OAuth applications as part of a phishing campaign designed to breach organizations' cloud environments and steal email. "The applications created by these fraudulen...
PT-2023-1628 · F5 · Big-Ip Apm
Name of the Vulnerable Software and Affected Versions: BIG-IP APM versions 13.1.x and 14.1.x through 14.1.5.2 Description: The issue is related to the BIG-IP APM system, where undisclosed requests may cause the Traffic Management Microkernel TMM to terminate when configured with specific elements...
F5 BIG-IP APM Oauth Denial of Service Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A denial-of-service vulnerability exists in F5 BIG-IP APM Oauth, which can be exploited by remote unauthenticated attackers t...
Fedora 36 : git-credential-oauth (2023-2663dc67d8)
The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-2663dc67d8 advisory. Rebuild for security fix Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...
WordPress OAuth Server Plugin <= 4.2.5 is vulnerable to Cross Site Request Forgery (CSRF)
Software OAuth Server Type Plugin Vulnerable versions = 4.2.5 Fixed in 4.3.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 98e63ca58462 Credits Unknown Required privilege...
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login...
GHSA-685J-36QX-3VP2 Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account...
GHSA-X9Q4-QWFH-9GJQ Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login...
Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24428
A cross-site request forgery CSRF vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24428
A cross-site request forgery CSRF vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24427
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login...
CVE-2023-24427
Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login...
Cross site request forgery (csrf)
A cross-site request forgery CSRF vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account...