Moneybird: Content Spoofing In Moneybird

Reporter found a content spoofing vulnerability in an OAuth related endpoint that reflected custom text present from the URL in the body. We have taken measurements to prevent this problem in the future...

X (Formerly Twitter): [Critical] - Steal OAuth Tokens

Hi, This bug is caused because of the same mis-configuration as 128119. Only this time Microsoft Outlook auth is vulnerable instead of Facebook. this time I will try to be as clear as possible. after sign up of Twitter, Twitter asks users to import contacts and it only requires on authorization -...

IBM WebSphere Application Server 7.0 < 7.0.0.41 / 8.0 < 8.0.0.12 / 8.5 < 8.5.5.9 OAuth Provider XSS

The IBM WebSphere Application Server running on the remote host is version 7.0 prior to 7.0.0.41, 8.0 prior to 8.0.0.12, or 8.5 prior to 8.5.5.9. It is, therefore, potentially affected by a reflected cross-site scripting XSS vulnerability due to a failure to properly validate output from the OAut...

Uber three tasteless exploits of magical-vulnerability warning-the black bar safety net

Author through careful design, will be a tasteless self-XSSand two tasteless csrf turned into a high-quality vulnerability. Original: https://fin1te.net/articles/uber-turning-self-xss-into-good-xss/ In Uber a set of personal information on the page, I found a very simple and...

IBM WebSphere Application Server Privilege Escalation Vulnerability (swg21697368)

IBM WebSphere Application Server is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft OAuth interface XSS, affecting user account security-vulnerability warning-the black bar safety net

One day, while I was browsing on Twitter information, I found a very interesting article, Wesley Wineberg in the Microsoft OAuth authentication interface found a CSRF vulnerability. This article makes me curious at the same time also provoked I can be in this place and then find a loophole of fai...

ThisData: Login CSRF using Google OAuth

This bug is related to bug report https://hackerone.com/reports/774 as this bug also allows a user to be logged in as the attacker. An attacker could exploit this bug as follows: Attacker initiates Google OAuth process with thisdata Attacker allows access to thisdata app Attacker records and drop...

X (Formerly Twitter): Bypassing Digits web authentication's host validation with HPP

Hi, I would like to report an issue on Digits web authentication which allows attackers to retrieve the OAuth credential data of an application victims authorized. Detail As described in 108429, the login page has 2 parameters, consumerkey and host. The former identifies which app a user wants to...

CVE-2015-7417

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider...

CVE-2015-7417: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM WebSphere Application Server 7.0 before 7.0.0.41, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.9 allows remote authenticated users to inject arbitrary web script or HTML via crafted data from an OAuth provider...

PT-2016-3768

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 7.0.0.40 IBM WebSphere Application Server versions 8.0 through 8.0.0.11 IBM WebSphere Application Server versions 8.5 through 8.5.5.8 Description A cross-site scripting XSS issue allows...

Shopify: Attach Pinterest account - no State/CSRF parameter in Oauth Call back

Hello There is no csrf protection for oauth call backs to attach a pinterest account. An attacker can escalate this to attach his account with the victims profile and monitor his activities. Vulnerable URL:...

X (Formerly Twitter): Bypassing Digits bridge origin validation

Hi, I would like to report an issue in the bridge proxy in Digits which allows attacker to retrieve the OAuth credential data of an application victims authorized. Detail In the Digits Web SDK, the method getLoginStatus can be used to retrieve the OAuth credential data of an application if the us...

X (Formerly Twitter): Insufficient OAuth callback validation which leads to Periscope account takeover

Hi, I would like to report an issue in the Periscope Twitter application which allows attacker to circumvent the callback locking to takeover victim's Periscope account which is connected to a Twitter account. Detail In the mobile Periscope app, the consumerkey and consumersecret for Twitter...

X (Formerly Twitter): Bypassing callback_url validation on Digits

Hi, I would like to report an issue in Digits which allows attacker to bypass the callbackurl validation of an application and thus takeover an account. Detail Digits is a part of the Fabric SDK which offers phone-based sign in. It also provides web login flow. In the navigation-based...

Scientific Linux Security Update : rest on SL7.x x86_64 (20151119)

It was found that the OAuth implementation in librest, a helper library for RESTful services, incorrectly truncated the pointer returned by the restproxycallgeturl call. An attacker could use this flaw to crash an application using the librest library. CVE-2015-2675 After installing the update, a...

Coinbase: Race condition allowing user to review app multiple times

There was a race condition present that would allow a user to review an OAuth application multiple times...

Top 10 OAuth 2 Implementation Vulnerabilities

Some time ago I posted a blogpost abut Top 5 OAuth 2 Implementation Vulnerabilities. This week I have extended the list while presenting Top X OAuth 2 Hacks at OWASP Switzerland. This blog post like the presentation is just a collection of interesting attack OAuth related. 10 The Postman Always...

Shopify: CSRF in Connecting Pinterest Account

Hi, The connect to Pinterest function is vulnerable to CSRF. This allows an attacker to connect his/her pinterest account to the victim's shopify. Even if the victim has already connected a pinterest account, this will allow the attacker to replace the existing connected pinterest account with th...