142 matches found
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, envoy-ratelimit, flux-image-reflector-controller, gke-gcloud-auth-plugin, yq, dataplaneapi, kubernetes-dns-node-cache, secrets-store-csi-driver-provider-aws, vexctl, nri-f5, dex, tailscale, task, regclient, sbomqs, nuclei, prometheus-adapter,...
CVE-2024-32638
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue...
CVE-2025-23506
CVE-2025-23506 is a Reflected XSS in the WP IMAP Auth plugin affecting versions up to 4.0.1 (NotFound WP IMAP Auth). The root cause is improper neutralization of input during web page generation. CVSS 3.1 base score 7.1 (HIGH) with NETWORK attacker, no user privileges, and user interaction requir...
Session Fixation
org.jenkins-ci.plugins, oic-auth is vulnerable to Session Fixation. The vulnerability is due to the plugin failing to invalidate the previous session on login, allowing an attacker to reuse an old session...
BIT-APISIX-2024-32638 Apache APISIX: Forward-Auth Request Smuggling
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue...
CVE-2024-32638
Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling' vulnerability in Apache APISIX when using forward-auth plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, which fixes the issue...
CVE-2024-32638
This CVE (CVE-2024-32638) concerns Apache APISIX and the forward-auth plugin, where an Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) vulnerability exists. Affected versions are APISIX 3.8.0 and 3.9.0; upgrading to 3.8.1, 3.9.1, or newer mitigates the issue. The vulnerabili...
PT-2024-24735 · Apache · Apache Apisix
Name of the Vulnerable Software and Affected Versions: Apache APISIX versions 3.8.0 through 3.9.0 Description: The issue is related to an Inconsistent Interpretation of HTTP Requests, also known as 'HTTP Request Smuggling', in Apache APISIX when using the forward-auth plugin. Recommendations: For...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: pulumi-language-java, envoy-ratelimit, gke-gcloud-auth-plugin, secrets-store-csi-driver, dex, prometheus-adapter, dgraph, ko, git-lfs, certificate-transparency, weaviate, flux-notification-controller, terraform-provider-azurerm, kubernetes-csi-livenessprobe, conftest...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin = 0.3.2 versions...
CVE-2023-27435
The CVE-2023-27435 entry concerns the WordPress HTTP Auth Plugin, vulnerable in versions 0.3.2, with patch 1.0.0 indicated as the fix. Exploitability details in the connected docs show unauthenticated access as a consideration; exploitation status is not definitively provided beyond the CSRF cla...
CVE-2023-27435 WordPress HTTP Auth Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Sami Ahmed Siddiqui HTTP Auth plugin = 0.3.2 versions...
PT-2023-21124 · Unknown · Sami Ahmed Siddiqui Http Auth Plugin
Name of the Vulnerable Software and Affected Versions: Sami Ahmed Siddiqui HTTP Auth plugin versions 0.3.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...
Code injection
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted...
CVE-2023-41945
The CVE-2023-41945 issue affects the Jenkins Assembla Auth Plugin (versions ≤ 1.14). Root cause: the plugin does not verify that permissions it grants are actually enabled, allowing users with EDIT to receive Overall/Manage and Overall/SystemRead permissions even when disabled. Impact: elevated p...
CVE-2023-41945
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and should not be granted...
WordPress HTTP Auth Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)
Software HTTP Auth Type Plugin Vulnerable versions = 0.3.2 Fixed in 1.0.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27435 Patch priority Low CVSS severity Low 6.3 Developer Claim ownership PSID 3c605b41c95d Credits Mika Required privilege...
GHSA-P756-66W2-35G7 Jenkins Assembla Auth Plugin vulnerable to cross-site request forgery
Jenkins Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account...
Jenkins Assembla Auth Plugin vulnerable to cross-site request forgery
Jenkins Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account...