EUVD-2008-0580

Malware in sbrugna...

ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

CVE-2008-0570: Improper Input Validation

The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimedid returned by an OpenID provider, which allows remote OpenID providers to spoof OpenID authentication for domains associated with other providers...

SA-2008-016 - OpenID - Incorrect claimed_id returned for OpenID 2.0

The OpenID module has a vulnerability which allows OpenID version 2.0 positive assertions that are not properly verified to return an invalid or impersonated claimedid. To exploit this vulnerability an attacker could set up an OpenID provider, example1.com, that claimed to be the authority for...