PT-2019-12147

Name of the Vulnerable Software and Affected Versions Ruby OpenID aka ruby-openid versions 2.8.0 and earlier Description The issue allows for a remotely exploitable flaw, specifically a Server-Side Request Forgery SSRF vulnerability. This occurs because the library performs discovery first, and...

CVE-2019-11027: Undefined Security Weakness

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

Unspecified Vulnerability in Ruby OpenID

Ruby OpenID is a Ruby library for providing and verifying OpenID identities. A security vulnerability exists in Ruby OpenID 2.8.0 and earlier versions. No details of the vulnerability are provided at this time...

CVE-2019-11066

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

CVE-2019-11066

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

Server side request forgery (ssrf)

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

CVE-2019-11066

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

CVE-2019-11066

CVE-2019-11066 affects LightOpenID up to version 1.3.1, where openid.php is vulnerable to SSRF via a crafted OpenID 2.0 assertion request that uses HTTP GET. The vulnerability originates in LightOpenID’s handling of OpenID 2.0 assertion requests, enabling server-side requests to arbitrary destina...

CVE-2019-11066

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

PT-2019-12163

Name of the Vulnerable Software and Affected Versions LightOpenID versions through 1.3.1 Description The issue allows for Server-Side Request Forgery SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method. This is related to the openid.php file in LightOpenID. Recommendations F...

CVE-2019-11066: Server-Side Request Forgery (SSRF)

openid.php in LightOpenID through 1.3.1 allows SSRF via a crafted OpenID 2.0 assertion request using the HTTP GET method...

Cross Site Scripting (XSS)

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

Arbitrary Code Execution

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1948,...

CloudBees Jenkins openid plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . openid Plugin is used in one of the...

CVE-2019-4155

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

Privilege escalation

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

CVE-2019-4155

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

PT-2019-16935

Name of the Vulnerable Software and Affected Versions IBM API Connect's Developer Portal versions 2018.1 through 2018.4.1.3 Description The issue is related to a privilege escalation vulnerability that occurs when IBM API Connect's Developer Portal is integrated with an OpenID Connect OIDC user...

CVE-2019-4155: Undefined Security Weakness

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

Security Bulletin: IBM API Connect's Developer Portal is impacted by a privilege escalation vulnerability (CVE-2019-4155)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2019-4155 DESCRIPTION: IBM API Connect's Developer Portal is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. CVSS Base Score: 8.8 CVSS...