CVE-2024-39694 Duende IdentityServer Open Redirect vulnerability

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it t...

CVE-2024-39694 Duende IdentityServer Open Redirect vulnerability

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it t...

CVE-2024-39694 Duende IdentityServer Open Redirect vulnerability

Duende IdentityServer is an OpenID Connect and OAuth 2.x framework for ASP.NET Core. It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it t...

URL Redirection to Untrusted Site ('Open Redirect')

Overview Affected versions of this package are vulnerable to URL Redirection to Untrusted Site 'Open Redirect' through the commonly used GetAuthorizationContextAsync and IsValidReturnUrl methods which return non-null values and the IsValidReturnUrl method which could return true for malicious URL...

Duende IdentityServer 安全漏洞

Duende IdentityServer is a Duende open source, standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core. A security vulnerability exists in Duende IdentityServer that stems from certain functions that incorrectly treat maliciously constructed URLs as local and trusted. An...

PT-2024-28632 · Microsoft +1 · Asp.Net Core +1

Name of the Vulnerable Software and Affected Versions: Duende IdentityServer versions 5.1 and earlier Duende IdentityServer versions 6.0 through 6.0.4 Duende IdentityServer versions 6.1 through 6.1.7 Duende IdentityServer versions 6.2 through 6.2.4 Duende IdentityServer versions 6.3 through 6.3.9...

Unfixed XSS vulnerability at www.duende.lt

Security researcher F3nix, has submitted on 25/02/2008 a cross-site-scripting XSS vulnerability affecting www.duende.lt, which at the time of submission ranked 3002966 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/03/2008. It is currently...