CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

Cumulative Update 67 for Microsoft Dynamics NAV 2016 (Build 52168)

None None...

Login with Cognito < 1.4.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Cognito Login » Configure OAuth", and a...

CVE-2022-3892

The WP OAuth Server OAuth Authentication WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3926

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3892

The WP OAuth Server OAuth Authentication WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3926

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

Cross site request forgery (csrf)

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

Cross site scripting

The WP OAuth Server OAuth Authentication WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3926

The CVE-2022-3926 issue affects the WP OAuth Server (OAuth Authentication) WordPress plugin, versions prior to 3.4.2. The root cause is a missing CSRF check when regenerating secrets, which could let an attacker who is logged in and knows a client ID trigger a secret regeneration for any client. ...

CVE-2022-3926 WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The WP OAuth Server OAuth Authentication WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID...

CVE-2022-3892

CVE-2022-3892 affects the WordPress plugin “WP OAuth Server (OAuth Authentication)”

CVE-2022-3892 WP OAuth Server < 4.2.2 - Admin+ Stored XSS

The WP OAuth Server OAuth Authentication WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3892 WP OAuth Server < 4.2.2 - Admin+ Stored XSS

The WP OAuth Server OAuth Authentication WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2022-24852 · WordPress · Wp Oauth Server

Name of the Vulnerable Software and Affected Versions: WP OAuth Server OAuth Authentication versions prior to 3.4.2 Description: The issue concerns a lack of CSRF check when regenerating secrets. This could allow attackers to make logged-in admins regenerate the secret of an arbitrary client, giv...

WordPress plugin WP OAuth Server 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-24617 · WordPress · Wp Oauth Server

Name of the Vulnerable Software and Affected Versions: WP OAuth Server OAuth Authentication versions prior to 4.2.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for examp...

CVE-2022-4145

A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation...

Red Hat OpenShift 注入漏洞

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that enables building, testing, deploying and running applications. Red Hat OpenShift has a security vulnerability that stems from a content spoofing flaw in OpenShift's OAuth endpoint, which can be...