DEBIAN-CVE-2019-13057

An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN database admin privileges for certain databases but wants to maintain isolation e.g., for multi-tenant deployments, slapd does not properly stop a rootDN from requesting authorization a...

Doorkeeper-openid_connect contains Open Redirect

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...

CVE-2019-9837

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...

PT-2019-19886

Name of the Vulnerable Software and Affected Versions Doorkeeper::OpenidConnect versions 1.4.x through 1.5.3 Description The issue allows for an open redirect via the redirect uri field in an OAuth authorization request, resulting in an error response when the 'openid' scope and a prompt=none val...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

HackerOne: Revoking user session in https://hackerone.com/settings/sessions does not revoke the GraphQL query session

Hi Team, Summary: I have found an Insufficient Session Expiration on implementation of the new Revoke user session feature of HackerOne here: https://hackerone.com/settings/sessions Description: The new REVOKE session feature will destroy the session of the selected device, that means any request...

spring-security-oauth: remote code execution in the authorization process

Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lea...

RCE with spring-security-oauth2 分析(CVE-2018-1260)

漏洞公告 环境搭建 利用github上已有的demo： git clone https://github.com/wanghongfei/spring-security-oauth2-example.git 确保导入的spring-security-oauth2为受影响版本，以这里为例为2.0.10 进入spring-security-oauth2-example，修改 cn/com/sina/alan/oauth/config/OAuthSecurityConfig.java的第67行: @Override public void...

CVE-2015-8466

CVE-2015-8466 affects OpenStack Swift3 (S3 compatibility) middleware, allowing a remote replay attack when an Authorization request lacks a Date header. The issue is in Swift3 by default up to version 1.9. Public fixes are available in upstream Swift3 release 1.9. Debian lists fixed packages 1.7-...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466

Removed by vendor...

CVE-2015-8466

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

CVE-2015-8466: Improper Input Validation

Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header...

PT-2016-3904

Name of the Vulnerable Software and Affected Versions Swift3 versions prior to 1.9 Description The issue allows remote attackers to conduct replay attacks. This is possible via an Authorization request that lacks a Date header. Recommendations For versions prior to 1.9, update to version 1.9 or...

&RQ buffer overflow

Authorization request buffer overflow...

SureCom EP-9510AXEP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service (1)

SureCom EP-9510AXEP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service 1 source: https://www.securityfocus.com/bid/9795/info An issue in the handling of specific web requests by SureCom network devices has been identified. By placing a malformed request to the web...