CVE-2014-6164

IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4 allows remote attackers to spoof OpenID and OpenID Connect cookies, and consequently obtain sensitive information, via a crafted URL...

CVE-2014-6164

CVE-2014-6164 (IBM WebSphere Application Server) affects IBM WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4. A remote attacker can spoof OpenID/OpenID Connect cookies via a crafted URL, potentially exposing sensitive information. Affected products/versions are listed in the IBM bulletin; reme...

CVE-2014-2684

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...

Authentication flaw

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...

CVE-2014-2684

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remo...

PHPYUN multiple SQL injection and rapid positioning disregard 3 6 0 defense-a vulnerability warning-the black bar safety net

Other local estimates are little friends are digging done, we see not often is attention of place In the QQ log in here qqconnect. class. php file We take a look qq landing, will bind the qq of the relevant information: code area function qqbindaction if$GET'usertype'=='1' || $GET'usertype'=='2' ...

Denial of Service in OpenID System Extension

More info at https://typo3.org/security/advisory/typo3-core-sa-2014-002...

Multiple Vulnerabilities in TYPO3 CMS

It has been discovered that TYPO3 CMS is vulnerable to Denial of Service and Arbitrary Shell Execution! Component Type: TYPO3 CMS Vulnerability Types: Denial of Service, Arbitrary Shell Execution Overall Severity: Medium Release Date: October 22, 2014 Vulnerable subcomponent: OpenID System...

Amazon Linux AMI : php-ZendFramework (ALAS-2014-377)

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

CVE-2014-2685

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

Authentication flaw

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

CVE-2014-2685

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

CVE-2014-2685

The CVE-2014-2685 issue affects ZendOpenId (GenericConsumer in ZendOpenId) prior to 2.0.2 and Zend Framework 1 prior to 1.12.4. Root cause: the OpenID 2.0 verification logic accepts a signature that covers only at least one field, allowing an attacker to bypass authentication by leveraging an ass...

CVE-2014-2685

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveragin...

SA-CORE-2014-004 - Drupal core - Denial of service

Drupal 6 and Drupal 7 include an XML-RPC endpoint which is publicly available xmlrpc.php. The PHP XML parser used by this XML-RPC endpoint is vulnerable to an XML entity expansion attack and other related XML payload attacks which can cause CPU and memory exhaustion and the site's database to rea...

Important: php-ZendFramework

Issue Overview: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass...

Insecure OpenID implementation - ownCloud

Due to an insecure OpenID implementation used by useropenid in ownCloud 5 it is possible to log-into a system using an arbitrary OpenID Account without knowing any secret information, i.e. the password, about it by using a malicious OpenID provider. Affected Software ownCloud Server 5.0.15...

Server: Insecure OpenID implementation

Due to an insecure OpenID implementation used by useropenid in ownCloud 5 it is possible to log-into a system using an arbitrary OpenID Account without knowing any secret information, i.e. the password, about it by using a malicious OpenID provider. For more information please consult the officia...

Fedora 19 : python-fedora-0.3.34-1.fc19 (2014-5948)

Fix two security issues for services using python-fedora's TG1 and flask helpers. The TG1 fix quotes variables that could have been used to launch an XSS attack. The flask fix addresses OpenID Covert Redirect for web services which use flaskfasopenid to authenticate against the Fedora Account...

GLSA-201405-14 : Ruby OpenID: Denial of Service

The remote host is affected by the vulnerability described in GLSA-201405-14 Ruby OpenID: Denial of Service An XML entity parsing error has been discovered in Ruby OpenID. Impact : A remote attacker could send a specially crafted XML file, possibly resulting in a Denial of Service condition...