PT-2018-17794

Name of the Vulnerable Software and Affected Versions Auth0 versions prior to 2017-10-15 Description The issue allows for privilege escalation due to the lack of validation of the JWT audience. Recommendations For versions prior to 2017-10-15, update to a version that includes the fix for the JWT...

FreeBSD : Gitlab -- multiple vulnerabilities (dc0c201c-31da-11e8-ac53-d8cb8abf62dd)

GitLab reports : SSRF in services and web hooks There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potential...

GitLab Auth0 integration configuration vulnerability

GitLab is a set of open source applications developed using Ruby on Rails to implement a self-hosted Git version control system project repository, which has similar functionality to Github for accessing the contents of a project's files, commit history, bug lists, and more. A security...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

Code injection

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

UBUNTU-CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

The CVE-2018-8971 issue affects GitLab releases prior to 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6, where an incorrect omniauth-auth0 configuration in the Auth0 integration allows signing in unintended users. The vulnerability has a high/critical impact (ATT&CK not specified in docs)...

CVE-2018-8971

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

CVE-2018-8971

Removed by vendor...

PT-2018-18750

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 10.3.9 GitLab versions 10.4.x prior to 10.4.6 GitLab versions 10.5.x prior to 10.5.6 Description The issue arises from an incorrect omniauth-auth0 configuration in the Auth0 integration, which can lead to signing in...

CVE-2018-8971: Improper Input Validation

The Auth0 integration in GitLab before 10.3.9, 10.4.x before 10.4.6, and 10.5.x before 10.5.6 has an incorrect omniauth-auth0 configuration, leading to signing in unintended users...

Gitlab -- multiple vulnerabilities

GitLab reports: SSRF in services and web hooks There were multiple server-side request forgery issues in the Services feature. An attacker could make requests to servers within the same network of the GitLab instance. This could lead to information disclosure, authentication bypass, or potentiall...

Auth0 auth0.js library cross-site request forgery vulnerability

Auth0 auth0.js library is the United States Auth0 company's set of Auth0 development platform tool library . A cross-site request forgery vulnerability exists in versions of the Auth0 auth0.js library prior to 9.3, which stems from the program failing to properly handle the absence of the 'state'...

@cimpress/simple-auth-wrapper (>=3.0.0, <=6.4.6), @p2/core (>=1.2.0-alpha.0, <=1.2.0) +7 more potentially affected by CVE-2018-7307 via auth0-js (>=9.0.0, <=9.2.2)

auth0-js NPM version =9.0.0, =3.0.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.3.47, =11.0.0-beta.2, =1.3.0, =1.3.2 - olymp-auth 20.1.42 Source cves: CVE-2018-7307 Source advisory: OSV:GHSA-WPQ7-Q8J4-72JG...

GHSA-WPQ7-Q8J4-72JG Auth0-js bypasses CSRF checks

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...

Auth0-js bypasses CSRF checks

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...