Updated shotwell packages fix security vulnerability

It was discovered that Shotwell is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission CVE-2017-1000024...

Design/Logic Flaw

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token...

CVE-2015-8008

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token...

CVE-2015-8008

CVE-2015-8008 relates to the MediaWiki OAuth extension. The description states that it improperly negotiates a new client token only over Special:OAuth/initiate, enabling attackers to bypass IP address access restrictions by making an API request with an existing token. The provided data does not...

CVE-2015-8008

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token...

CVE-2015-8008: Improper Access Control

The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access restrictions by making an API request with an existing token...

@cimpress/simple-auth-wrapper (>=2.2.0, <=2.2.3), @expo/auth0-lock (10.16.0) +18 more potentially affected by CVE-2017-17068 via auth0-js (>=8.0.0-beta.1, <=8.11.3)

auth0-js NPM version =8.0.0-beta.1, =2.2.0, =1.1.0, =1.1.0, =1.1.0, =1.0.0, =0.0.18, =1.5.0, =0.0.1, =10.8.0-beta.2, =1.0.8, =1.0.15 - ds-auth0-lock 1.0.0 and more Source cves: CVE-2017-17068 Source advisory: OSV:GHSA-3RPR-MG43-XHQ4...

Mapbox: Admin Panel Accessed (OAuth Bypassed )

On December 4, 2017, @aneeskhan reported an authentication bypass vulnerability on a Mapbox internal portal. The vulnerability allowed them to bypass OAuth authentication and generate a valid session for the site. This session was then used by @aneeskhan to access information on the portal which...

Ed: Possible to redirect to a (non-existing) subdomain after logging in via GitHub (leaking the token)

Summary To comment on an article a user has the option to login using his Github account. After logging in the user is normally redirect back to the URL he came from. I found out that it is also possible to redirect to a non-existing subdomain of edoverflow.com. It looks like the whitelist for th...

Ed: Oauth flow on the comments widget login can lead to the access code leakage

Description Hello. Here is a keyword: frog I discovered an little Oauth flow in the comments widget authentication process using redirecturi manipulations. The widget located on the all blogposts, which have URL https://edoverflow.com/2017/post-title/ Upon authentication, it appeared that code...

Information Disclosure

spring-oauth-security is vulnerable to information disclosure attacks. Upon a server exception, confidential information is printed to the logs...

Authentication flaw

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

CVE-2017-12160

CVE-2017-12160 affects Keycloak-based Red Hat Single Sign-On (rh-sso7-keycloak). The flaw in the OAuth flow permits an authenticated resource to obtain an access/refresh token pair from the authentication server, enabling indefinite usage if permissions are revoked. An attacker on a already-compr...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

PT-2017-12375

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw was discovered in Keycloak oauth that allows an authenticated resource to obtain an access/refresh token pair from the authentication server. This permits indefinite usage even in the...

How to use OAuth error configuration to achieve the takeover of the Flickr account of the object-vulnerability warning-the black bar safety net

! Flickr is Yahoo's a picture of the video sharing sites, and presumably everyone is very understanding. Yahoo today, the application of the OAuth authentication situation instead of the previous the disembarkation method. The author of this article via a process of reflection on the disembarkati...

CVE-2017-12160

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself...

Chrome 35.0.1916.153 - Sandbox Escape Command Execution

Chrome 35.0.1916.153 - Sandbox Escape Command Execution Sandbox escape Chrome exploit. Allows the execution of local binaries, read/write functions and exfiltration of Chrome OAuth tokens to remote server. More info: https://bugs.chromium.org/p/chromium/issues/detail?id=386988 Download:...