950 matches found
CVE-2018-6874
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...
CVE-2018-6874
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...
CVE-2018-6873
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...
Cross site request forgery (csrf)
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...
Privilege escalation
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...
CVE-2018-6873
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...
CVE-2018-6874
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...
CVE-2018-6873
CVE-2018-6873 affects Auth0 authentication service prior to 2017-10-15, where JWT audience validation was not performed, enabling privilege escalation. Multiple sources describe that the vulnerability allowed a remote attacker to authenticate as a higher-privilege user by forging or manipulating ...
CVE-2018-6874
CVE-2018-6874 describes a CSRF flaw in Auth0's authentication service when the Legacy Lock API flag is enabled. The vulnerability allows an attacker to reuse a valid signed JWT to perform actions in the victim’s account if the user visits a malicious page. Documents indicate the issue affected Au...
CVE-2018-6873: Improper Authentication
The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated...
CVE-2018-6874: Cross-Site Request Forgery (CSRF)
CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled...
PT-2018-17795
Name of the Vulnerable Software and Affected Versions Auth0 authentication service through 14591 Description A CSRF issue exists in the Auth0 authentication service when the Legacy Lock API flag is enabled. Recommendations For versions through 14591, disable the Legacy Lock API flag to mitigate t...
PT-2018-17794
Name of the Vulnerable Software and Affected Versions Auth0 versions prior to 2017-10-15 Description The issue allows for privilege escalation due to the lack of validation of the JWT audience. Recommendations For versions prior to 2017-10-15, update to a version that includes the fix for the JWT...
FreeBSD : Gitlab -- multiple vulnerabilities (dc0c201c-31da-11e8-ac53-d8cb8abf62dd)
GitLab reports : SSRF in services and web hooks There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potential...
GitLab Auth0 integration configuration vulnerability
GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A security...
CVE-2018-8971
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...
CVE-2018-8971
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...
Code injection
The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...
