5280 matches found
GO-2024-2852 Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana
Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, plea...
CVE-2024-4540
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...
CVE-2024-4540 Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...
CVE-2024-4540 Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...
CVE-2024-4540
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests PAR. Client-provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request, possibly leading to an information...
The vulnerability of the caddy-security authentication plugin, related to the use of insufficiently random values, allows attackers to execute OAuth interception attacks and generate insecure, repeated authentication and API key checks in the database.
The vulnerability of the caddy-security authentication plugin is related to the use of insufficiently random values. Exploiting this vulnerability allows a remote attacker to execute an OAuth hijacking attack and generate insecure, repeated authentication and API key checks in the database...
RHEL 5 : firefox (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla: Malicious Extension could obtain auth codes from OAuth login flows CVE-2020-6823 - Mozilla Firef...
RHEL 8 : firefox (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla: Type confusion for special arguments in IonMonkey CVE-2020-15656 - Mozilla: Malicious Extension...
RHEL 7 : firefox (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla: Type confusion for special arguments in IonMonkey CVE-2020-15656 - Mozilla: Malicious Extension...
EvilSlackbot - A Slack Bot Phishing Framework For Red Teaming Exercises
EvilSlackbot A Slack Attack Framework for conducting Red Team and phishing exercises within Slack workspaces. Disclaimer This tool is intended for Security Professionals only. Do not use this tool against any Slack workspace without explicit permission to test. Use at your own risk. Background...
CVE-2024-36370
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible...
CVE-2024-36370
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible...
CVE-2024-36368
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible...
CVE-2024-36368
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible...
CVE-2024-36370
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible...
CVE-2024-36370
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 stored XSS via OAuth connection settings was possible...
CVE-2024-36370
JetBrains TeamCity is affected by CVE-2024-36370: stored XSS via OAuth connection settings. Affected versions: before 2022.04.7, 2022.10.6, 2023.05.6, or 2023.11.5. The vulnerability stems from lacking proper sanitization in OAuth connection settings, enabling an attacker to inject script through...
CVE-2024-36368
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 reflected XSS via OAuth provider configuration was possible...
CVE-2024-36368
CVE-2024-36368 affects JetBrains TeamCity prior to version 2022.04.7, 2022.10.6, 2023.05.6, and 2023.11.5. The issue is a cross-site scripting (XSS) vulnerability that arises from insufficient protection of the OAuth provider configuration, allowing a crafted payload to be reflected via that conf...