CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

PT-2020-10151

Name of the Vulnerable Software and Affected Versions Abacus OAuth Login versions 2019 01 r4 20191021 0000 through prior to R4 20.11.2019 Hotfix Description The issue allows Reflected Cross Site Scripting XSS via an error message. This occurs in the "oauth/oauth2/v1/saml/" endpoint. Recommendatio...

CVE-2019-19381: Improper Neutralization of Input During Web Page Generation

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

Cross-Site Request Forgery (CSRF)

cloud foundry uaa is vulnerable to cross-site request forgery CSRF. The vulnerability exists as the OAuth2 state parameter is not being validated in the callback function when authenticating with external identity providers...

CVE-2020-5402

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

Design/Logic Flaw

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402

The CVE-2020-5402 issue affects Cloud Foundry UAA (and related deployments) where versions prior to 74.14.0 allow CSRF via the OAuth2 state parameter not being validated in the external identity provider callback. The core vulnerability is a missing check in the callback flow, impacting authentic...

PT-2020-18458

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.14.0 Description A CSRF issue exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Recommendations For versions prior t...

CVE-2020-5402: Cross-Site Request Forgery (CSRF)

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402: UAA fails to check the state parameter when authenticating with external IDPs | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Affected Cloud Foundry Products...

omniauth-weibo-oauth2 gem for Ruby Code Execution Vulnerability

The omniauth-weibo-oauth2 gem for Ruby is a Ruby-based authentication package. A security vulnerability exists in the omniauth-weibo-oauth2 gem for Ruby version 0.4.6 deployed on RubyGems.org. An attacker can exploit the vulnerability to execute code...

Buffer overflow

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...

CVE-2019-17268

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...

CVE-2019-17268

The CVE-2019-17268 entry concerns the Ruby gem omniauth-weibo-oauth2.0.4.6 distributed on RubyGems.org, which contains a code-execution backdoor inserted by a third party. The vulnerability affects version 0.4.6; versions through 0.4.5, and 0.5.1 and later, are unaffected. The root cause is malic...

Nextcloud Server < 12.0.8, < 13.0.3 Improper Input Vulnerability (NC-SA-2018-003)

Nextcloud Server is prone to an improper input vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2020-9886

Name of the Vulnerable Software and Affected Versions omniauth-weibo-oauth2 gem version 0.4.6 Description The issue concerns a code-execution backdoor inserted by a third party into the omniauth-weibo-oauth2 gem for Ruby. Recommendations For version 0.4.6, update to a version outside the affected...

CVE-2019-17268: Improper Control of Generation of Code

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...