5050 matches found
Dropbox client - Multiple Vulnerabilities - SA-CONTRIB-2016-027
This module enables you to view dropbox files in your Drupal site. The module doesn't sufficiently sanitize filenames when displaying them to users or administrators leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to...
Holy redirect_uri Batman!
If you bought the book I have been writing with Justin Richer namely OAuth 2 in Action you might have noticed that we will never got tired to stress out how much important the redirecturi is in the OAuth 2 universe. Failing to understand this rather simple concept might lead to disasters. The...
Vimeo: OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing
Hello Vimeo Security Team, There is a vulnerability in api.vimeo.com/oauth which allows an attacker to gain full App privilege over a Vimeo victim user account without user approval, just by having the victim open a link to the attacker webpage. Proof of Concept link :...
Moneybird: Employees with Any Permissions Can Create App with Full Permissions and Perform any API Action
By changing the POST parameters of an OAuth authentication call, it was possible to get full permissions to an administration for which the user has limited access. With the fix in place, access will be denied when the administration id is changed...
Moneybird: Content Spoofing In Moneybird
Reporter found a content spoofing vulnerability in an OAuth related endpoint that reflected custom text present from the URL in the body. We have taken measurements to prevent this problem in the future...
X (Formerly Twitter): [Critical] - Steal OAuth Tokens
Hi, This bug is caused because of the same mis-configuration as 128119. Only this time Microsoft Outlook auth is vulnerable instead of Facebook. this time I will try to be as clear as possible. after sign up of Twitter, Twitter asks users to import contacts and it only requires on authorization -...
IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS
The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.41, 8.0 prior to 8.0.0.12, or 8.5 prior to 8.5.5.9. It is, therefore, potentially affected by a reflected cross-site scripting XSS vulnerability due to a failure to properly validate output from the OAut...
Uber three tasteless exploits of magical-vulnerability warning-the black bar safety net
Author through careful design, will be a tasteless self-XSSand two tasteless csrf turned into a high-quality vulnerability. Original: https://fin1te.net/articles/uber-turning-self-xss-into-good-xss/ In Uber a set of personal information on the page, I found a very simple and...
IBM WebSphere Application Server Privilege Escalation Vulnerability (swg21697368)
IBM WebSphere Application Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Microsoft OAuth interface XSS, affecting user account security-vulnerability warning-the black bar safety net
One day, while I was browsing on Twitter information, I found a very interesting article, Wesley Wineberg in the Microsoft OAuth authentication interface found a CSRF vulnerability. This article makes me curious at the same time also provoked I can be in this place and then find a loophole of fai...
ThisData: Login CSRF using Google OAuth
This bug is related to bug report https://hackerone.com/reports/774 as this bug also allows a user to be logged in as the attacker. An attacker could exploit this bug as follows: Attacker initiates Google OAuth process with thisdata Attacker allows access to thisdata app Attacker records and drop...
X (Formerly Twitter): Bypassing Digits web authentication's host validation with HPP
Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized. Detail As described in 108429, the login page has 2 parameters, consumerkey and host. The former identifies which app a user wants to...
CVE-2015-7417
Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider...
Cross site scripting
Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider...
Shopify: Attach Pinterest account - no State/CSRF parameter in Oauth Call back
Hello There is no csrf protection for oauth call backs to attach a pinterest account. An attacker can escalate this to attach his account with the victims profile and monitor his activities. Vulnerable URL:...
X (Formerly Twitter): Bypassing Digits bridge origin validation
Hi, I would like to report an issue in the bridge proxy in Digits which allows attacker to retrieve the OAuth credential data of an application victims authorized. Detail In the Digits Web SDK, the method getLoginStatus can be used to retrieve the OAuth credential data of an application if the us...
X (Formerly Twitter): Insufficient OAuth callback validation which leads to Periscope account takeover
Hi, I would like to report an issue in the Periscope Twitter application which allows attacker to circumvent the callback locking to takeover victim's Periscope account which is connected to a Twitter account. Detail In the mobile Periscope app, the consumerkey and consumersecret for Twitter...
X (Formerly Twitter): Bypassing callback_url validation on Digits
Hi, I would like to report an issue in Digits which allows attacker to bypass the callbackurl validation of an application and thus takeover an account. Detail Digits is a part of the Fabric SDK which offers phone-based sign in. It also provides web login flow. In the navigation-based...
Scientific Linux Security Update : rest on SL7.x x86_64 (20151119)
It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the restproxycallgeturl call. An attacker could use this flaw to crash an application using the librest library. CVE-2015-2675 After installing the update, a...