CVE-2017-1000024

CVE-2017-1000024 affects Shotwell up to 0.24.4 and 0.25.3 or earlier, with an information disclosure in the web publishing plugins that could leak passwords and OAuth tokens in plaintext. The issue is confirmed across multiple advisories (Mageia/SUSE/openSUSE/Ubuntu) and is addressed by applying ...

CVE-2017-1000024

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission...

PT-2017-10734

Name of the Vulnerable Software and Affected Versions Shotwell versions 0.24.4 or earlier Shotwell versions 0.25.3 or earlier Description The issue concerns an information disclosure in the web publishing plugins of Shotwell, potentially resulting in the plaintext transmission of passwords and...

PT-2017-10777

Name of the Vulnerable Software and Affected Versions Bitly oauth2 proxy versions 2.1 and earlier Description The issue is related to an open redirect vulnerability that occurs during the start and termination of the 2-legged OAuth flow. This is caused by improper input validation and a violation...

Uber Patches Authentication Bypass Vulnerability on Custom SSO Solution

Uber has addressed a vulnerability that allowed attackers to steal session tokens and hijack accounts. Researcher Arne Swinnen disclosed details Monday after confirming late last week that the issue had been resolved; he earned $5,000 in bounties from Uber. Swinnen said that if exploited at a lar...

Drupal OAuth Module Access Bypass Vulnerability

Drupal is an open source content management framework CMF written in the PHP language, which consists of a content management system CMS and PHP development framework Framework together. An access bypass vulnerability exists in the Drupal OAuth module. Allows an attacker to bypass certain securit...

How Can I dig to a value of $ 8000 Uber vulnerability-vulnerability warning-the black bar safety net

I study Uber vulnerability has been there for some time, and this is the first time I posted about the Uber vulnerability discovery report, I hope can give you some interesting burrowing ideas. In this article, I will share with you the one I'm in the Uber system in the discovery of interesting...

OAuth - Critical - Access Bypass - SA-CONTRIB-2017-056

This module enables you to protect requests via the OAuth authentication protocol. The module doesn't sufficiently notify the Cache API to avoid caching responses under the scenario in which an authenticated user requests a resource such as unpublished node. This vulnerability is mitigated by the...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

Design/Logic Flaw

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

The CVE describes an OAuth token access-control flaw in Odoo: in Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, an incorrect access-control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users. Affe...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805: Incorrect Authorization

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

PT-2017-11516

Name of the Vulnerable Software and Affected Versions Odoo versions 8.0, 9.0, and 10.0 Odoo Community Edition versions 9.0 and 10.0 Odoo Enterprise Edition versions 9.0 and 10.0 Description The issue is related to incorrect access control on OAuth tokens in the OAuth module, allowing remote...

WakaTime: IDOR create accounts and verify them with original account email

Good evening, Vulnerability I'm able to create accounts with the email verification that originates from the first account I created. After changing the confirmemail request body to a different email.. After I use that verification link that account is now under my control and bypasses...

Inflection: Open Redirect

Researcher discovered an issue in the Identity.com OAuth flow, where crafting an /authorize URL with certain parameters missing would enable an attacker to redirect the end user to an arbitrary URL if the redirecturi variable was included...

Inflection: Open Redirect through POST Request

The HTTP POST request to /oauth/authorize could be tampered with to allow an attacker to maliciously redirect the user to an arbitrary URL after failed authentication. Due to how the OAuth protocol works, the attacker would need to MITM or otherwise tamper with the request from a local network, a...