com.aliyun.openservices:sls-android-okhttp (1.0.0), com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1) +89 more potentially affected by CVE-2016-2402 via com.squareup.okhttp3:okhttp (>=3.0.0, <=3.1.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0, =4.0.0, =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =0.1.0-beta02, =17.0.2, =17.0.6, =17.0.0, =17.0.1 and more Source cves: CVE-2016-2402 Source advisory: GHSA-4HC2-JH7R-WRC3...

com.aliyun.openservices:sls-android-okhttp (1.0.0), com.appunite:websockets-rxjava (>=4.0.0, <=4.0.1) +89 more potentially affected by CVE-2016-2402 via com.squareup.okhttp3:okhttp (>=3.0.0, <=3.1.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0, =4.0.0, =0.2.0, =1.0.1, =2.0.0, =1.0.0, =1.3.0, =0.1.0-beta02, =17.0.2, =17.0.6, =17.0.0, =17.0.1 and more Source cves: CVE-2016-2402 Source advisory: OSV:GHSA-4HC2-JH7R-WRC3...

GHSA-4HC2-JH7R-WRC3 Improper Certificate Validation in OkHttp

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate...

CVE-2021-21430

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

Design/Logic Flaw

OpenAPI Generator allows generation of API client libraries SDK generation, server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data...

CVE-2021-21430

OpenAPI Generator contains a vulnerability where code generated for Java/Scala performs insecure temporary file creation via File.createTempFile, risking exposure of application/data when handling binary uploads/downloads. Affected generators include Java (jersey2, okhttp-gson default) and scala-...

ai.ancf.lmos:lmos-operator (>=0.5.0, <=0.6.0), ai.berktest:berkclient (>=1.0.0, <=1.0.3) +19388 more potentially affected by CVE-2021-0341 via com.squareup.okhttp3:okhttp (>=3.0.0-rc1, <=4.9.1)

com.squareup.okhttp3:okhttp MAVEN version =3.0.0-rc1, =0.5.0, =1.0.0, =0.42.1, =0.42.1, =0.40.2, =0.42.1, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =1.4.2, =3.8.3.1, =3.46.0.12 and more Source cves: CVE-2021-0341 Source advisory: MEND:CVE-2021-0341...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - OkHttp 3.x (CVE-2018-20200)

Summary CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. Vulnerability Details CVEID: CVE-2018-20200 DESCRIPTION: DISPUTED CertificatePinner.java in...

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

Authorization

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

CVE-2020-12624

CVE-2020-12624 affects The League application on Android prior to 2020-05-02. The flaw stems from reusing an OkHttp object, causing a bearer token in the HTTP Authorization header to be sent to an arbitrary external site hosting an image. This enables remote attackers to hijack sessions. Red Hat ...

CVE-2020-12624

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

PT-2020-13172

Name of the Vulnerable Software and Affected Versions The League application versions prior to 2020-05-02 Description The issue allows remote attackers to hijack sessions because the application sends a bearer token in an HTTP Authorization header to an arbitrary web site hosting an external imag...

CVE-2020-12624: Incomplete Cleanup

The League application before 2020-05-02 on Android sends a bearer token in an HTTP Authorization header to an arbitrary web site that hosts an external image because an OkHttp object is reused, which allows remote attackers to hijack sessions...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

OkHttp Certificate Pinning Vulnerability CVE-2016-2402

h3. Issue Summary Portfolio uses Okhttp 2.2.0 which has an identified vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2016-2402 https://www.securityfocus.com/bid/83296/info https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ h3. Steps to Reproduce...

ca.uhn.hapi.fhir:hapi-fhir-android (2.3), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.3) +21 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.3)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.3 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.3 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.3 -...

ca.uhn.hapi.fhir:hapi-fhir-android (2.4), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.4) +76 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.4)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.4 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.4 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.4 -...

ca.uhn.hapi.fhir:hapi-fhir-android (2.0), ca.uhn.hapi.fhir:hapi-fhir-client-okhttp (2.0) +25 more potentially affected by CVE-2019-12741 via ca.uhn.hapi.fhir:hapi-fhir-base (2.0)

ca.uhn.hapi.fhir:hapi-fhir-base MAVEN version 2.0 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:hapi-fhir-base and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-android 2.0 - ca.uhn.hapi.fhir:hapi-fhir-client-okhttp 2.0 -...