958 matches found
CVE-2019-20174
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...
Cross-Site Scripting (XSS)
Auth0-Lock is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary and execute arbitrary Javascript into a user's browser via the placeholder property. Customers using the additionalSignUpFields customization option are affected...
CVE-2019-20174: Improper Neutralization of Input During Web Page Generation
Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...
@brudi-toolbox/id (>=1.4.5-next.1, <=1.11.4-next.7), @cimpress/simple-auth-wrapper (>=3.0.0, <=3.1.6) +4 more potentially affected by CVE-2019-20174 via auth0-lock (>=11.0.1, <=11.20.4)
auth0-lock NPM version =11.0.1, =1.4.5-next.1, =3.0.0, =0.0.1, =1.0.42, =0.11.0, =0.17.1 Source cves: CVE-2019-20174 Source advisory: OSV:GHSA-W2PF-G6R8-PG22...
GHSA-W2PF-G6R8-PG22 auth0-lock vulnerable to XSS via unsanitized placeholder property
Overview Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to the sign-up dialog that are passing a placeholder property obtained from an untrusted source e.g. a query paramet...
auth0-lock vulnerable to XSS via unsanitized placeholder property
Overview Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the additionalSignUpFields customization option to add a checkbox to the sign-up dialog that are passing a placeholder property obtained from an untrusted source e.g. a query paramet...
Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
XSS via a wle parameter associated with wp-login.php. PoC WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...
Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
XSS via a wle parameter associated with wp-login.php. WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...
WordPress Login by Auth0 plugin <= 3.11.2 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability
Unauthenticated Reflected Cross-Site Scripting XSS vulnerability found by Muhamad Visat in WordPress Login by Auth0 plugin versions = 3.11.2. Solution Update the WordPress Login by Auth0 plugin to the latest available version at least 3.11.3...
PT-2020-10358
Name of the Vulnerable Software and Affected Versions Auth0 Lock versions prior to 11.21.0 Description The issue arises when additionalSignUpFields is used with an untrusted placeholder in Auth0 Lock, allowing cross-site scripting XSS on signup pages. This occurs when the placeholder property is...
GHSA-C9CG-Q8R2-XVJQ Improper Authentication in Auth0.AuthenticationApi
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
Improper Authentication in Auth0.AuthenticationApi
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
Incorrect Access Control
auth0.net uses an incorrect access control. The IdentityTokenValidator can be used to validate untrusted ID tokens which can be used to bypass access controls and gain unauthorized access to the application...
CVE-2019-16929
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
CVE-2019-16929
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
Design/Logic Flaw
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
CVE-2019-16929
Auth0 .NET library (auth0.net) prior to version 6.5.4 contains an Incorrect Access Control vulnerability: IdentityTokenValidator can be used to validate untrusted ID tokens, potentially bypassing access controls. Affected component is the IdentityTokenValidator in auth0.net; the root cause is imp...
CVE-2019-16929
Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens...
