Cross site request forgery (csrf)

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-3119 OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-3119 OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they...

CVE-2022-3119

The CVE-2022-3119 issue affects the WordPress plugin “OAuth client Single Sign On” prior to version 3.0.4. The vulnerability arises from lack of authorization checks and CSRF protection when updating plugin settings, enabling unauthenticated attackers to modify OAuth endpoints under their control...

PT-2022-20598 · WordPress · Oauth Client Single Sign On

Name of the Vulnerable Software and Affected Versions: OAuth client Single Sign On WordPress plugin versions prior to 3.0.4 Description: The issue concerns a lack of authorization and CSRF protection when updating settings in the OAuth client Single Sign On WordPress plugin. This could allow...

Security Bulletin: Possible Security Exposure in WebSphere Application Server CVE-2013-0597 PM85834

Abstract Potential security exposure in WebSphere Application Server Content VULNERABILITY DETAILS: CVE ID:CVE-2013-0597 PM85834 and PM87131 DESCRIPTION: WebSphere Application Server using OAuth could allow a remote attacker to obtain someone else's credentials. A remote attacker could exploit th...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

Information disclosure

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

Design/Logic Flaw

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32217

Summary: CVE-2022-32217 affects Rocket.Chat prior to v4.6.4, where an OAuth token is leaked in plaintext in logs, leading to potential information disclosure. What’s affected: Rocket.Chat versions before 4.6.4; the issue is a cleartext storage/disclosure of sensitive OAuth tokens in logs. Root ca...

CVE-2022-32217

A cleartext storage of sensitive information exists in Rocket.Chat v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32227

CVE-2022-32227 affects Rocket.Chat prior to v5, v4.8.2, and v4.7.5, where a user with the permission view-full-other-user-info could access another user’s OAuth tokens via the REST API (users.info). The root cause is cleartext transmission/leak of sensitive OAuth token data. Impact described incl...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

CVE-2022-32227

A cleartext transmission of sensitive information exists in Rocket.Chat v5, v4.8.2 and v4.7.5 relating to Oauth tokens by having the permission "view-full-other-user-info", this could cause an oauth token leak in the product...

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. This is a post from HackRead.com Read the...

Hackers Using Fake CircleCI Notifications to Hack GitHub Accounts

GitHub has put out an advisory detailing what may be an ongoing phishing campaign targeting its users to steal credentials and two-factor authentication 2FA codes by impersonating the CircleCI DevOps platform. The Microsoft-owned code hosting service said it learned of the attack on September 16,...