CVE-2022-3632 OAuth Client by DigitialPixies <= 1.1.0 - CSRF

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions...

CVE-2022-43687

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

CVE-2022-3632 OAuth Client by DigitialPixies <= 1.1.0 - CSRF

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions...

CVE-2022-43693

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth...

CVE-2022-3631 OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite...

WordPress plugin OAuth Client by DigitialPixies 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2022-23305 · Digitialpixies · Oauth Client

Name of the Vulnerable Software and Affected Versions: OAuth Client by DigitialPixies WordPress plugin versions prior to 1.1.1 Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capabilit...

CVE-2022-43687

Concrete CMS (formerly concrete5) vulnerability CVE-2022-43687 affects versions below 8.5.10 and 9.0.0–9.1.2, where the OAuth authentication flow does not issue a new session ID after successful login. This insecure session management could allow session fixation-like scenarios as described in mu...

CVE-2022-3632

CVE-2022-3632 affects the WordPress plugin OAuth Client by DigitialPixies (versions prior to 1.1.1). The issue is a CSRF vulnerability due to missing CSRF checks in certain locations, enabling an attacker to cause logged-in users to perform unwanted actions. Affected component: OAuth Client plugi...

CVE-2022-3631

CVE-2022-3631 affects the WordPress plugin OAuth Client by DigitialPixies (versions

CVE-2022-43693

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth...

WordPress plugin OAuth Client by DigitialPixies 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2022-43687

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

CVE-2022-3631 OAuth Client by DigitialPixies <= 1.1.0 - Admin+ Stored Cross-Site Scripting

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, in multisite...

CVE-2022-43687

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+...

PT-2022-23310 · Digitialpixies · Oauth Client

Name of the Vulnerable Software and Affected Versions: OAuth Client by DigitialPixies WordPress plugin versions prior to 1.1.1 Description: The issue is related to the lack of CSRF checks in certain areas, allowing attackers to potentially make logged-in users perform unwanted actions...

CVE-2022-43693

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of the box" core OAuth...

PT-2022-27003 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS formerly concrete5 versions below 8.5.10 Concrete CMS formerly concrete5 versions 9.0.0 through 9.1.2 Description: The issue arises when Concrete CMS does not issue a new session ID upon successful OAuth authentication. This can...

WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The plugin does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID PoC Make a logged in admin open a page containing the HTML code below. This will regenerate the secret for...

WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

The plugin does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID Make a logged in admin open a page containing the HTML code below. This will regenerate the secret for the...