PT-2019-12717 · Identityserver · Identityserver

Name of the Vulnerable Software and Affected Versions: IdentityServer versions 4 through 2.4 Description: The issue is related to stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method. This can be triggered by viewing a log. It's worth noting...

CVE-2018-8899

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations...

CVE-2018-8899

CVE-2018-8899 affects IdentityServer4: versions 1.x before 1.5.3 and 2.x before 2.1.3 do not encode the redirect URI on the authorization response page, which may allow a cross-site scripting (XSS) payload in certain configurations. The root cause is lack of encoding on the redirect URI in the au...

IdentityServer Cross-Site Scripting Vulnerability

IdentityServer is an open source OAuth framework for ASP.NET Core. A cross-site scripting vulnerability exists in IdentityServer versions 4 1.x prior to 1.5.3 and 2.x prior to 2.1.3, which stems from the program's failure to encode a redirect URL on the Authorization Response page.A remote attack...

IdentityServer3 authorize response page cross-site scripting vulnerability

IdentityServer3 is a .NET-based access control plug-in for Web applications. A cross-site scripting vulnerability in the Angular expression of the IdentityServer3 authorize response page allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be use...