CVE-2021-32828

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting XSS. This XSS can be escalated to Remote Code Execution RCE by levering the automation API...

CVE-2021-32828 Regular expression Denial of Service in MooTools

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting XSS. This XSS can be escalated to Remote Code Execution RCE by levering the automation API...

CVE-2021-32828: Deserialization of Untrusted Data

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting XSS. This XSS can be escalated to Remote Code Execution RCE by levering the automation API...

CVE-2021-32828

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the "oauth2" REST API is vulnerable to Reflected Cross-Site Scripting XSS. This XSS can be escalated to Remote Code Execution RCE by levering the automation API...

PT-2023-12175 · Nuxeo · Nuxeo Platform

Name of the Vulnerable Software and Affected Versions: Nuxeo Platform version 11.5.109 Description: The Nuxeo Platform is an open source content management platform for building business applications. In the affected version, the oauth2 REST API is vulnerable to Reflected Cross-Site Scripting XSS...

Nextcloud: Mail app stores cleartext password in database until OAUTH2 setup is done

A vulnerability was found in the Nextcloud Mail app where the password for XOAUTH2 accounts was stored in clear text in the database during the setup process, until the OAUTH2 setup was completed. This could have allowed a database administrator to read the plaintext password...

HCL BigFix Multiple Vulnerabilities (KB0098998)

The version of HCL BigFix Client installed on the remote host is affected by multiple vulnerabilities, including the following: - An improper authentication vulnerability exists in the curl subcomponent which might allow reuse OAUTH2-authenticated connections without properly making sure that the...

CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

Sql injection

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

PT-2022-24424 · Unknown · Logrocket-Oauth2-Example

Name of the Vulnerable Software and Affected Versions: logrocket-oauth2-example versions prior to 2020-05-27 Description: The issue allows SQL injection via the /auth/register API endpoint, specifically through the username parameter. Recommendations: For versions prior to 2020-05-27, as a...

logrocket-oauth2-example SQL注入漏洞

logrocket-oauth2-example is a source code implementation of OAuth 2.0 in Node.js by the individual developer Diogo Souza. logrocket-oauth2-example suffers from a SQL injection vulnerability that originates from inserting unfiltered user input into a SQL query, making it susceptible to SQL injecti...

CVE-2022-38488: Improper Neutralization of Special Elements used in an SQL Command

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

CVE-2022-38488

CVE-2022-38488 affects logrocket-oauth2-example (pre-2020-05-27). The underlying issue is SQL injection in the /auth/register endpoint where the username parameter is inserted into a SQL query without proper sanitization. This leads to potential disclosure, modification, or destruction of data (p...

CVE-2022-38488

logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...

Nextcloud: OAuth2 "authorization_code" is valid indefinetly

A security advisory reported that the OAuth2 endpoint was not following best practices, as the authorization code was generated without a timeout, allowing an attacker with access to obtain and redeem the code in the future...

curl security update

7.76.1-19 - fix unpreserved file permissions CVE-2022-32207 - fix HTTP compression denial of service CVE-2022-32206 - fix FTP-KRB bad message verification CVE-2022-32208 7.76.1-18 - fix too eager reuse of TLS and SSH connections CVE-2022-27782 7.76.1-17 - fix leak of SRP credentials in redirects...

Privilege Escalation

Spring Security OAuth2 Client is vulnerable to Privilege Escalation. The vulnerability exists in the getTokenResponse function in multiple files due to the authorization server responding with an OAuth2 access token response containing an empty scope list which allows an attacker to modify reques...

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...

Authorization

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client via the browser to the Authorization Server which...