7206 matches found
CVE-2018-1000088
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...
CVE-2018-1000088
CVE-2018-1000088 affects Doorkeeper versions 2.1.0 through 4.2.5 with a Stored XSS vulnerability in the web view of the OAuth client form (name field) that can execute payloads when a user interacts with an injected link. The root cause is improper handling of client names in the OAuth flow, allo...
CVE-2018-1000088
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...
PT-2018-9267
Name of the Vulnerable Software and Affected Versions: Doorkeeper versions 2.1.0 through 4.2.5 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the web view's OAuth app form and user authorization prompt web view. This can result in Stored XSS on the OAuth Client's...
CVE-2018-1000088: Improper Neutralization of Input During Web Page Generation
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting XSS vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be...
Chrome 35.0.1916.153 - Sandbox Escape / Command Execution Exploit
Exploit for windows platform in category local exploits Sandbox escape Chrome exploit. Allows the execution of local binaries, read/write functions and exfiltration of Chrome OAuth tokens to remote server. More info: https://bugs.chromium.org/p/chromium/issues/detail?id=386988 Download:...
CVE-2017-7419
A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider...
Cross site scripting
A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider...
CVE-2017-7419
A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider...
CVE-2017-7419 NetIQ Access Manager OAuth Consent screen XSS attack
A OAuth application in NetIQ Access Manager 4.3 before 4.3.2 and 4.2 before 4.2.4 allowed cross site scripting attacks due to unescaped "description" field that could be specified by the provider...
Mail.ru: Stored self-xss and its escalation to a victim account in e.mail.ru
Stored XSS via external OAuth account data...
CVE-2017-5249
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
Code injection
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
Code injection
In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
CVE-2017-5249
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
CVE-2017-5250
In version 1.9.7 and prior of Insteon's Insteon for Hub Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
CVE-2017-5249
In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Home Android app, the OAuth token used by the app to authorize user access is not stored in an encrypted and secure manner...
CVE-2017-5249
CVE-2017-5249 affects Wink Labs’ Wink – Smart Home Android app (version 6.1.0.19 and earlier). The root cause is insecure storage of the OAuth token used to authorize user access, potentially exposing sensitive information. The provided sources describe the vulnerability and its existence but do ...