7311 matches found
Consensys: Sub-Domain Takeover at http://www.codefi.consensys.net/
Summary: Subdomain takeovers: A subdomain takeover occurs when an attacker gains control over a subdomain of a target domain. Typically, this happens when the subdomain has a canonical name CNAME in the Domain Name System DNS, but no host is providing content for it. This can happen because eithe...
CVE-2020-15331
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded OAUTHSECRETKEY in /opt/axess/etc/default/axess...
Rocket.Chat log information leakage vulnerability
Chat is a set of open source team chat software. Rocket.Chat v4.6.4 and earlier versions contain an information disclosure vulnerability, which stems from OAuth tokens being leaked in plaintext in the logs. An attacker could use this vulnerability to obtain sensitive information...
Rocket.Chat Information Disclosure Vulnerability (CNVD-2022-69164)
Rocket.Chat is an open source team chat software. Rocket.Chat suffers from an information disclosure vulnerability that stems from the presence of a clear-text transfer of sensitive information related to an oauth token, causing the oauth token to be leaked in the product. An attacker could explo...
WordPress OAuth client Single Sign On Cross-Site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
Exchange servers abused for spam through malicious OAuth applications
Microsoft has published a security blog about an investigation into an attack in which threat actors used malicious OAuth applications to abuse Exchange servers for their spam campaign. The threat actor behind this attack has been active for many years, and has been running spam campaigns using...
CVE-2022-3119
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
CVE-2022-3119
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
Cross site request forgery (csrf)
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
CVE-2022-3119 OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
CVE-2022-3119
The CVE-2022-3119 issue affects the WordPress plugin “OAuth client Single Sign On” prior to version 3.0.4. The vulnerability arises from lack of authorization checks and CSRF protection when updating plugin settings, enabling unauthenticated attackers to modify OAuth endpoints under their control...
CVE-2022-3119 OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
CVE-2022-3119: Improper Authentication
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...
PT-2022-20598 · WordPress · Oauth Client Single Sign On
Name of the Vulnerable Software and Affected Versions: OAuth client Single Sign On WordPress plugin versions prior to 3.0.4 Description: The issue concerns a lack of authorization and CSRF protection when updating settings in the OAuth client Single Sign On WordPress plugin. This could allow...
Security Bulletin: Possible Security Exposure in WebSphere Application Server CVE-2013-0597 PM85834
Abstract Potential security exposure in WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0597 PM85834 and PM87131 DESCRIPTION: WebSphere Application Server using OAuth could allow a remote attacker to obtain someone else's credentials. A remote attacker could exploit th...
CVE-2022-32227
A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...
CVE-2022-32217
A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...
Information disclosure
A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...
Design/Logic Flaw
A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...
