115 matches found
jira-ssrf
jira-ssrf CVE-2017-9506 Atlassian OAuth 插件的 IconUriServlet（1.3.0 至 1.9.12 之前的版本，以及 2.0.0 至 2.0.4 之前的版本）允许远程攻击者通过服务器端请求伪造（SSRF）访问内部网络资源的内容和/或执行 XSS 攻击。...
Jira-Scan
Jira-Scan 仅使用 PYTHON 3 测试过 提供一个网站列表（不包含 http 或 https），该工具将针对每个网站测试 SSRF 漏洞。 使用来自 DO 的 VPS CVE-2017-9506 在版本 1.3.0（含）至 1.9.12（不含）以及 2.0.0（含）至 2.0.4（不含）中，Atlassian OAuth Plugin 的 IconUriServlet 允许远程攻击者通过服务端请求伪造（SSRF）访问内部网络资源的内容和/或执行 XSS 攻击。 根据 Atlassian Jira 的信息，以下版本存在漏洞： Jira 7.3.5 SSRF 概述...
CVE-2017-9506
概念验证 SSRF & XSS https://jira.you.com//plugins/servlet/oauth/users/icon-uri?consumerUri=http://www.google.co.uk CVE-2017-9506 Atlassian OAuth 插件中从 1.3.0 版本到 1.9.12 版本之前，以及从 2.0.0 版本到 2.0.4 版本之前的 IconUriServlet 允许远程攻击者通过服务器端请求伪造（SSRF）访问内部网络资源的内容和/或执行 XSS 攻击。 根据 Atlassian Jira 的说明，以下版本存在漏洞： Jira 7.3...
CVE-2026-59655
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...
CVE-2026-59655 Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...
EUVD-2026-63844
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...
PT-2026-79319
Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.19.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the OAuth authentication plugin occurs while listing OAuth providers, leading to the exposure of sensitive...
CVE-2026-11832
The Dancer2::Plugin::Auth::OAuth Perl module in versions prior to 0.22 is vulnerable to the use of a predictable nonce . The root cause is that the software generates the default nonce using an MD5 hash of the epoch time , which allows for predictability. This vulnerability could potentially impa...
GHSA-R8FJ-RFF6-F7H5 Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. Bitbucket OAuth Plugin 0.18 only...
CVE-2026-48924
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-48924
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-48924: URL Redirection to Untrusted Site
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
Jenkins Bitbucket OAuth Plugin 安全漏洞
The Jenkins Bitbucket OAuth Plugin is an open-source identity authentication plugin for Jenkins. Versions of the Jenkins Bitbucket OAuth Plugin prior to 0.17 contain security vulnerabilities. These vulnerabilities stem from the lack of restrictions on the redirection URL after login, which may...
Malicious code in gridsome-oauth-bulma-html-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f07451b678a3fdfbd18a8d0021a392029d22dd35b437bdc15c8d3c07a3555463 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-113065
Malicious code in gridsome-oauth-bulma-html-webpack-plugin npm...
CVE-2025-12021
The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
WordPress WP-OAuth plugin <= 0.4.1 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin WP-OAuth versions = 0.4.1...
WordPress plugin WP-OAuth 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A cross-sit...
PT-2025-46272
Name of the Vulnerable Software and Affected Versions WP-OAuth plugin for WordPress versions up to and including 0.4.1 Description The WP-OAuth plugin for WordPress is susceptible to Reflected Cross-Site Scripting. This is due to insufficient input sanitization and output escaping related to the...