HTCondor 路径遍历漏洞

HTCondor is a workload management system at the University of Wisconsin-Madison USA. The system provides job queuing mechanisms, scheduling policies, prioritization schemes, resource monitoring and resource management. A path traversal vulnerability exists in HTCondor prior to version 8.9.11 that...

Security Advisory 2021-01-17-1 - OpenWrt forum break-in on 16-Jan-2021

DESCRIPTION Around 0400 GMT on 16 Jan 2021, an administrator account on the OpenWrt forum https://forum.openwrt.org was breached. It is not known how the account was accessed: the account had a good password, but did not have two-factor authentication enabled. The intruder was able to download a...

OX App Suite server-side request forgery vulnerability (CNVD-2021-03039)

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A server-side request forgery vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct a server-side request forgery...

CVE-2021-23927

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

CVE-2021-23927

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

Design/Logic Flaw

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

PT-2021-15613

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.4 and earlier Description: The issue allows for Server-Side Request Forgery SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request. This can potentially be exploited by sending a crafted reque...

Open-xchange OX App Suite 代码问题漏洞

OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A server-side request forgery vulnerability exists in OX App Suite 7.10.4. An attacker can exploit this vulnerability to conduct a server-side request forgery...

CVE-2021-23927: Server-Side Request Forgery (SSRF)

OX App Suite through 7.10.4 allows SSRF via a URL with an @ character in an appsuite/api/oauth/proxy PUT request...

Mail.ru: Social Oauth Disconnect CSRF at znakcup.ru

The social-disconnect/twitter/ API maded possible to unlink Twitter OAuth from user account on znakcup.ru...

Bumble: Misconfigured oauth leads to Pre account takeover

Summary While testing badoo i have noticed that users can use SMAL Google,MSN,VKontakte,Odnoklassniki,Yandex Mail.Ru to create and login to badoo accounts. Now there are two ways of registering into badoo By email registration Google,MSN,VKontakte,Odnoklassniki,Yandex,Mail.Ru oauth login Now here...

PT-2021-4082 · Gitlab +1 · Gitlab Ce/Ee +2

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.10 and later Description: The issue is related to a cross-site leak vulnerability in the OAuth flow, allowing an attacker to leak an OAuth access token. This can be achieved by convincing a user to visit a malicious pa...

JFrog Artifactory < 7.10.2 Authentication Bypass

An authentication bypass vulnerability exists in JFrog Artifactory prior to 7.10.2 due to a vulnerability in google-oauth-client library. An unauthenticated, remote attacker can exploit this, by a using malicious app on the client-side to obtain the authorization code and use it to gain...

Fedora: Security Advisory for python-authlib (FEDORA-2020-b90dac7fc4)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

XSS Vulnerability in PigX Rapid Development Framework

PigX Rapid Development Framework is based on Spring Security OAuth2 to achieve account password , SMS verification code login , social login , etc., to provide an open platform based on OAuth2 authorization code mode . PigX Rapid Development Framework has an XSS vulnerability. Attackers can use t...

Security Bulletin: Upgrade javaenv:2.2 to address Gradle oauth authentication concerns.

Summary The version of Gradle shipped in the Fabric java chaincode environment image version 2.2. javaenv.2.2 depends on a vulnerable version of the google ouatth client. Vulnerability Details CVEID: CVE-2020-7692 DESCRIPTION: Google APIs google-oauth-java-client could allow a remote attacker to...

CVE-2020-26250

CVE-2020-26250 affects OAuthenticator (used by JupyterHub). In versions 0.12.0–0.12.1, the deprecated Authenticator.whitelist is ignored, effectively allowing any authenticated user if no group restrictions exist. Provider-based restrictions are unaffected. A log line such as Not using allowed_us...

openSUSE Security Update : rclone (openSUSE-2020-2008)

This update for rclone fixes the following issues : rclone was updated to version 1.53.3 : - Bug Fixes - Fix incorrect use of math/rand instead of crypto/rand CVE-2020-28924 boo1179005 Nick Craig-Wood - Check https://github.com/rclone/passwordcheck for a tool check for weak passwords generated by...

Security Bulletin: a security update of the google oauth client library to version 1.31.0 for CVE-2020-7692.

Summary This fix is a security update of the google oauth client library to version 1.31.0 for CVE-2020-7692. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|--- IBM Spectrum LSF| 10.1...

Dropbox: `account_info.read` scope OAuth app access token can change token owner's account name.

Previously, Dropbox API was split between App Folder and Full Dropbox apps. After the recent introduction of Scoped Access apps, which use OAuth scopes, a number of routes meant specifically for internal use were neither restricted to internal apps nor were they annotated with required scopes. A...