Auth0 跨站脚本漏洞

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. Auth0-lock suffers from a cross-site scripting vulnerability in versions prior to 11.30.0 that can be exploited by an attacker to execute...

GHSA-58R4-H6V8-JCVM Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

Regression in JWT Signature Validation

Overview Versions after and including 2.3.0 are improperly validating the JWT token signature when using the JWTValidator.verify method. Improper validation of the JWT token signature when not using the default Authorization Code Flow can allow an attacker to bypass authentication and...

Regression in JWT Signature Validation

Overview Affected versions of this package are vulnerable to Regression in JWT Signature Validation. It improperly validates the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and...

Authorization Bypass

omniauth-auth0 is vulnerable to authorization bypass. The vulnerability exists through a regression made in code that validates JWT token signatures, where it is possible to bypass authentication and authorization when the default Authorization Code Flow is not used...

CVE-2020-15240

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

CVE-2020-15240

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

Authorization

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

CVE-2020-15240

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

CVE-2020-15240 Regression in JWT Signature Validation

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

CVE-2020-15240

Summary: The vulnerability CVE-2020-15240 affects the Ruby gem omniauth-auth0 (versions >= 2.3.0 and

CVE-2020-15240

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

CVE-2020-15240

Removed by vendor...

PT-2020-14305

Name of the Vulnerable Software and Affected Versions omniauth-auth0 versions 2.3.0 through 2.4.0 Description The issue concerns improper validation of the JWT token signature when using the jwt validator.verify method, potentially allowing an attacker to bypass authentication and authorization...

CVE-2020-15240: Improper Authentication

omniauth-auth0 rubygems versions = 2.3.0 and 2.4.1 improperly validate the JWT token signature when using the jwtvalidator.verify method. Improper validation of the JWT token signature can allow an attacker to bypass authentication and authorization. You are affected by this vulnerability if all ...

Cross-Site Scripting (XSS)

auth0-lock is vulnerable to cross-site scripting XSS. When using Passwordless or Enterprise connection mode, an attacker is able to inject and execute arbitrary Javascript in a victim's browser via the email or phone number in Passwordless connection, and the IdP domain in Enterprise connection...

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

Cross site scripting

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...