MAL-2025-901 Malicious code in auth0-open-source-template (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c14dd94f3cdea34f9073f26be0716cfd944e0362396ae1dccab12196021a328c The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Malicious code in auth0-lock-browserify (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9512 Malicious code in auth0-lock-browserify (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rbds-frill-auth0-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 150dbdfd8f858852151c86f252e31bbb62cb7fdd4afb0babf23f9817a5a222ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in rbds-frill-auth0-integration

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Cross-Site Scripting (XSS)

auth0/wordpress is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of the wle parameter, which could accept an arbitrary string and be improperly rendered on the login page, resulting in Cross-Site Scripting XSS...

GHSA-X6P7-44RH-M3RR Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting

Impact The Auth0 WordPress plugin allows site administrators to opt-in to allowing the use of a wle parameter, which can be passed to the WordPress login page by end users. When this parameter is supplied using an expected value which is randomly generated by the plugin, by default, the end user...

Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting

Impact The Auth0 WordPress plugin allows site administrators to opt-in to allowing the use of a wle parameter, which can be passed to the WordPress login page by end users. When this parameter is supplied using an expected value which is randomly generated by the plugin, by default, the end user...

Duplicate Advisory: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6p7-44rh-m3rr. This link has been maintained to preserve external references. Original Description The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter...

GHSA-52JW-F3JQ-HHWG Duplicate Advisory: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6p7-44rh-m3rr. This link has been maintained to preserve external references. Original Description The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter...

CVE-2023-6813

The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-6813 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle

The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2023-6813

CVE-2023-6813 affects the Login by Auth0 plugin for WordPress. All versions up to 4.6.0 are vulnerable to Reflected XSS via the wle parameter due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts in pages executed after user actions (e.g....

CVE-2023-6813 Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle

The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress Login by Auth0 plugin <= 4.6.0 - Reflected Cross-Site Scripting via wle vulnerability

Reflected Cross-Site Scripting via wle vulnerability discovered by Krzysztof Zając in WordPress Plugin Login by Auth0 versions = 4.6.0...

WordPress Login by Auth0 Plugin <= 4.6.0 is vulnerable to Cross Site Scripting (XSS)

Software Login by Auth0 Type Plugin Vulnerable versions = 4.6.0 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6813 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 700ddc0d68f5 Credits Krzysztof Zając...

CVE-2023-6813: Improper Neutralization of Input During Web Page Generation

The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Malicious code in auth0-authz-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc031877d6efc19470df3d757e067cb9fd38974fd69be4140e854f2ca69840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in auth0-dashboard-widget

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in auth0-authz-extension

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...