CVE-2017-1000070: URL Redirection to Untrusted Site

The Bitly oauth2proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819...

UBUNTU-CVE-2017-1000024

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission...

CVE-2017-1000024: Cleartext Transmission of Sensitive Information

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission...

CVE-2017-1000024

CVE-2017-1000024 affects Shotwell up to 0.24.4 and 0.25.3 or earlier, with an information disclosure in the web publishing plugins that could leak passwords and OAuth tokens in plaintext. The issue is confirmed across multiple advisories (Mageia/SUSE/openSUSE/Ubuntu) and is addressed by applying ...

CVE-2017-1000070

The Bitly oauth2proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819...

CVE-2017-1000024

Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission...

PT-2017-10734

Name of the Vulnerable Software and Affected Versions Shotwell versions 0.24.4 or earlier Shotwell versions 0.25.3 or earlier Description The issue concerns an information disclosure in the web publishing plugins of Shotwell, potentially resulting in the plaintext transmission of passwords and...

PT-2017-10777

Name of the Vulnerable Software and Affected Versions Bitly oauth2 proxy versions 2.1 and earlier Description The issue is related to an open redirect vulnerability that occurs during the start and termination of the 2-legged OAuth flow. This is caused by improper input validation and a violation...

Uber Patches Authentication Bypass Vulnerability on Custom SSO Solution

Uber has addressed a vulnerability that allowed attackers to steal session tokens and hijack accounts. Researcher Arne Swinnen disclosed details Monday after confirming late last week that the issue had been resolved; he earned $5,000 in bounties from Uber. Swinnen said that if exploited at a lar...

How Can I dig to a value of $ 8000 Uber vulnerability-vulnerability warning-the black bar safety net

I study Uber vulnerability has been there for some time, and this is the first time I posted about the Uber vulnerability discovery report, I hope can give you some interesting burrowing ideas. In this article, I will share with you the one I'm in the Uber system in the discovery of interesting...

Drupal OAuth Module Access Bypass Vulnerability

Drupal is an open source content management framework CMF written in the PHP language, which consists of a content management system CMS and PHP development framework Framework together. An access bypass vulnerability exists in the Drupal OAuth module. Allows an attacker to bypass certain securit...

OAuth - Critical - Access Bypass - SA-CONTRIB-2017-056

This module enables you to protect requests via the OAuth authentication protocol. The module doesn't sufficiently notify the Cache API to avoid caching responses under the scenario in which an authenticated user requests a resource such as unpublished node. This vulnerability is mitigated by the...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

Design/Logic Flaw

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

The CVE describes an OAuth token access-control flaw in Odoo: in Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, an incorrect access-control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users. Affe...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805: Incorrect Authorization

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...