IBM-Security-Verify-oAuth_Token_Steal-CVE-2024-35133

IBM Security Verify Access - OAuth 흐름 중 오픈 리다이렉트 CVE-2024-35133 목차 1. 개요 2. 상세 설명 3. 개념 증명 4. 해결 방안 5. 공개 타임라인 6. 참조 7. 크레딧 8. 법적 고지 개요 개정 버전 : 1.0 영향 : 원격 공격자는 피해자를 특수하게 제작된 웹사이트를 방문하도록 유도함으로써 이 취약점을 악용하여 표시되는 URL을 스푸핑하고 사용자를 악성 웹사이트로 리다이렉트할 수 있습니다. 이를 통해 공격자는 매우 민감한 정보를 획득하거나 피해자에 대한 추가 공격을 수행할...

CVE-2017-15394

CVE-2017-15394 Chromium 브라우저 62.0.3202.62 미만 버전의 확장 프로그램 UI에서 URL 스푸핑 결함이 발견되었습니다. 확장 프로그램을 통한 Chromium의 IDN homograph 공격 데모. 1. Chrome에 압축 해제된 확장 프로그램 로드 2. 확장 프로그램 세부 정보를 보고 punycode 부재 확인 영향 공격자는 이 취약점을 이용하여 피해자가 예상치 못한 도메인에 확장 프로그램 권한을 부여하도록 강제함으로써 속임수 공격을 돕습니다. 패치 2017년 10월 17일 릴리스:...

CVE-2026-13277

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-15412

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

EUVD-2026-78071

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-13277 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-13277

The IBM Verify Identity Access and IBM Security Verify Access products are vulnerable to an open redirect attack . A remote attacker can exploit this by persuading a victim to visit a specially crafted website, allowing them to spoof the URL and redirect the user to a malicious site that appears ...

CVE-2026-13277 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web si...

CVE-2026-15412 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

EUVD-2026-78067

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

CVE-2026-15412 IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

PT-2026-91465

Name of the Vulnerable Software and Affected Versions IBM Verify Identity Access affected versions not specified Description An open redirect issue allows a remote attacker to conduct phishing attacks. By persuading a victim to visit a specially crafted website, an attacker can spoof the displaye...

PT-2026-91449

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability t...

GO-2026-6345 Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea

Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea...

CVE-2026-18487

A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...

Exploit for CVE-2026-21020

--- CVE-2026-21020 – Protobuf Message Parsing Polymorphic De...

CVE-2026-67350

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...

Linux Distros Unpatched Vulnerability : CVE-2026-17849

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox URL...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the handling of the forwarded-proto header when generating public URLs. An attacker can cause the application to generate spoofed canonical URLs by injecting or manipulating the forwarded-proto header value...

GHSA-V8F2-2GHQ-9WHV Gitea forwarded-proto validation allows canonical URL spoofing

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation...