CVE-2020-15119

CVE-2020-15119 concerns the auth0-lock widget. Vulnerability: using dangerouslySetInnerHTML to update the DOM can enable cross-site scripting (XSS) when Passwordless or Enterprise connections are used. Affected versions: before and including 11.25.1. Impact: potential exposure of arbitrary JavaSc...

CVE-2020-15119

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

CVE-2020-15119 DOM-based XSS in auth0-lock

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

DOM-based XSS

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

@brudi-toolbox/id (>=1.4.5-next.1, <=1.14.15), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2020-15119 via auth0-lock (>=11.0.1, <=11.26.1)

auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.21.2 Source cves: CVE-2020-15119 Source advisory: OSV:GHSA-6GG3-PMM7-97XC...

GHSA-6GG3-PMM7-97XC DOM-based XSS in auth0-lock

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

DOM-based XSS in auth0-lock

Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. - For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...

PT-2020-14200

Name of the Vulnerable Software and Affected Versions auth0-lock versions prior to 11.26.3 Description The issue exposes applications and their users to cross-site scripting XSS attacks due to the use of dangerouslySetInnerHTML to update the DOM. This occurs when auth0-lock is used with...

CVE-2020-15119: Improper Neutralization of Input During Web Page Generation

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...

Information Disclosure

auth0 is vulnerable to information disclosure. When Auth0's management API is used to a Machine to Machine application authorization, it does not sanitize DenyList of specific key in the Authorization header and logs Authorization header value, exposing a bearer tokens...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Authorization

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

Information Exposure

Overview Versions of auth0 before 2.27.1 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be logg...

@architect-io/cli (>=0.3.13, <=0.5.2-rc.7), @bagevent/taro-component (1.0.0) +33 more potentially affected by CVE-2020-15125 via auth0 (>=2.0.0-alpha.6, <=2.25.1)

auth0 NPM version =2.0.0-alpha.6, =0.3.13, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =4.0.0, =0.0.23, =1.8.0, =0.0.34, =0.0.1, =0.0.34, =3.1.0, =4.0.0 and more Source cves: CVE-2020-15125 Source advisory: OSV:GHSA-5JPF-PJ32-XX53...

GHSA-5JPF-PJ32-XX53 Authorization header is not sanitized in an error object in auth0

Overview Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be...

Authorization header is not sanitized in an error object in auth0

Overview Versions before and including 2.27.0 use a block list of specific keys that should be sanitized from the request object contained in the error object. When a request to Auth0 management API fails, the key for Authorization header is not sanitized and the Authorization header value can be...

CVE-2020-15125

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...

CVE-2020-15125 Authorization header is not sanitized in an error object in auth0

In auth0 npm package versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer...