MoinMoin has multiple vulnerabilities related to superuser list, xmlrpc and OpenID configuration

Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured...

GHSA-6CJ8-C359-P7Q9 Drupal vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

Drupal vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

The vulnerability of the authentication and authorization module for the Apache 2.x HTTP server, Mod_auth_openidc, allows a perpetrator to compromise data integrity.

The vulnerability of the authentication and authorization module for the Apache 2.x HTTP server, Modauthopenidc, is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

CVE-2022-24794

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

Open redirect

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

CVE-2022-24794 Open Redirect in express-openid-connect

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

CVE-2022-24794

Express OpenID Connect (express-openid-connect) CVE-2022-24794 describes an Open Redirect vulnerability when requiresAuth is applied on a catch-all route. Affected versions are prior to 2.7.2. The issue arises because the original URL reported by the Express framework is not properly sanitized, a...

CVE-2022-24794 Open Redirect in express-openid-connect

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

@afiether/gateware-kit (>=1.0.0 <=1.2.18), @afiether/kit (>=1.0.0 <=1.2.17) +42 more potentially affected by CVE-2022-24794 via express-openid-connect (>=0.5.0 <=2.20.2)

express-openid-connect NPM version =0.5.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.0.0, =1.1.6, =1.2.9 and more Source cves: CVE-2022-24794 Source advisory: OSV:GHSA-7P99-3798-F85C...

GHSA-7P99-3798-F85C URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect

Impact Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route. If all routes under example.com are protected with the requiresAuth middleware, a visit to...

Auth0 Express OpenId Connect 输入验证错误漏洞

Auth0 Express OpenId Connect is an open source component of Auth0 Inc. Express.js middleware used to protect the OpenID Connect web application. An input validation error vulnerability exists in Auth0 Express OpenId Connect versions prior to 2.7.2, which stems from the vulnerability of users of t...

Glewlwyd SSO server 安全漏洞

Glewlwyd SSO server is a single sign-on SSO server for multi-factor authentication for OAuth2 and OpenID Connect authentication. A security vulnerability exists in babelouest Glewlwyd SSO server versions 2.x through 2.6.2, which stems from a buffer overflow in the scheme/webauthn.c file in the...

CVE-2021-45786

In maccms v10, an attacker can log in through /index.php/user/login in the "col" and "openid" parameters to gain privileges...

Maccms 授权问题漏洞

Maccms program is a complete and powerful fast website building system running in PHP MYSQL environment. Maccms has an elevation of privilege vulnerability, which can be exploited by attackers to gain privileges through the "col" and "openid" parameters in /index.php/user/login to obtain privileg...

Security Bulletin: Code execution vulnerability in WebSphere Application Server affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-1851)

Summary There is a potential code execution vulnerability in WebSphere Application Server Liberty OpenID connect which affects IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID: CVE-2018-1851 DESCRIPTION: IBM WebSphere Application Server OpenID Connect...

Gitea < 1.7.0 SSRF Vulnerability

Gitea is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:gitea:gitea";...

Gitea Cross-Site Request Forgery Vulnerability (CNVD-2022-11513)

Gitea is a lightweight Go-based git service developed by the Gitea community. Gitea is vulnerable to a cross-site request forgery vulnerability, which stems from the product's OpenID URL not validating the user's identity and could be exploited to cause client-side code execution...

Server-side Request Forgery (SSRF)

github.com/go-gitea/gitea is vulnerable to server-side request forgery. The vulnerability exists in the SignInOpenIDPost function of authopenid.go as it does not properly hide error information and logs, allowing an attacker to gain sensitive information about the local network...

GHSA-8H8P-X289-VVQR Gitea displaying raw OpenID error in UI

Gitea is a project to help users set up a self-hosted Git service. Server Side Request Forgery SSRF vulnerability exists in Gitea before 1.7.0 using the OpenID URL. Gitea can leak sensitive information about the local network through the error provided by the UI...