MAL-2025-6806 Malicious code in react-native-kraken-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6dd9f629078cdad7b927b9f85f1d8b3a5d381a6009e08c65eafca6272b20cbf2 The OpenSSF Package Analysis project identified 'react-native-kraken-oauth' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

PT-2025-32408 · Unknown · Zlt2000 Microservices-Platform

Name of the Vulnerable Software and Affected Versions: zlt2000 microservices-platform versions through 6.0.0 Description: A problematic issue exists in zlt2000 microservices-platform. The issue is related to an open redirect vulnerability within the onLogoutSuccess function located in the file...

WakaTime: Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorize

The WakaTime OAuth authorization flow was vulnerable to a double-clickjacking attack. The attack allowed an attacker to trick users into unknowingly clicking the "Connect my WakaTime account" button in the consent dialog, enabling the attacker to register an OAuth application, capture the...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

ROS-20250731-01

Vulnerability in the implementation of OAuth request signing logic for Python OAuthLib is due to insufficient user data validation in urivalidate functions. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

CVE-2025-6505

Summary of CVE-2025-6505 : Progress Software’s Hybrid Data Pipeline Server (Linux) versions ≤ 4.6.2.3226 are affected. The root issue is that during an OAuth handshake the server accepts client credentials from both HTTP headers and request parameters, enabling attackers to combine credentials fr...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

PT-2025-31201 · Progress · Hybrid Data Pipeline Server

Name of the Vulnerable Software and Affected Versions: Progress Software Hybrid Data Pipeline Server versions 4.6.2.3226 and below Description: The Hybrid Data Pipeline Server is susceptible to unauthorized access and impersonation. Attackers can combine credentials from multiple sources,...

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...

CVE-2025-54529

CVE-2025-54529 : JetBrains TeamCity prior to 2025.07 has a cross-site request forgery (CSRF) vulnerability in the external OAuth login integration. The issue arises from insufficient validation of the request source, enabling an attacker to forge a login-related request and potentially hijack a u...

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...

CVE-2025-54529

In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration...

Improper Authentication

goauthentik.io is vulnerable to improper authentication. The vulnerability is due to deactivated users who registered or linked accounts via OAuth/SAML retaining partial access, which allows an attacker to authorize applications if they know the application URL, despite their account being...

PT-2025-31119 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: TeamCity versions prior to 2025.07 Description: A Cross-Site Request Forgery CSRF issue existed in the external OAuth login integration. Recommendations: Update TeamCity to version 2025.07 or later...

CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...

CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...