CVE-2019-9837

Doorkeeper::OpenidConnect aka the OpenID Connect extension for Doorkeeper 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirecturi field in an OAuth authorization request that results in an error response with the 'openid' scope and a prompt=none value. This allows phishing attacks...

CVE-2019-9837

The CVE-2019-9837 issue affects Doorkeeper::OpenidConnect (OpenID Connect extension for Doorkeeper) versions 1.4.x and 1.5.x prior to 1.5.4. An open redirect can occur via the redirect_uri field in an OAuth authorization request when the request includes the 'openid' scope and prompt=none, potent...

Rockstar Games: Image injection /br/games/info may lead to phishing attacks or FB OAuth theft.

In this report, the researcher identified an attack chain that could result in an attacker stealing sensitive user tokens such as Oauth tokens via full URL inclusion in the Referer header. One step of this attack involved an image injection exploit on localized versions of the games/info section ...

GHSA-77RV-6VFW-X4GC spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

PHPMyWind data/api/oauth/connect.php reflective cross-site scripting vulnerability

PHPMyWind is a PHP + MySQL based development , W3C standard building engine . A reflective cross-site scripting vulnerability exists in PHPMyWind data/api/oauth/connect.php. An attacker can exploit the vulnerability to obtain sensitive information such as user cookies...

CVE-2019-3778 Open Redirect in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778

The CVE-2019-3778 entry concerns an open redirect vulnerability in Spring Security OAuth where an attacker can abuse the redirect_uri parameter at the authorization endpoint to redirect a user-agent to an attacker-controlled URI, leaking the authorization code. Affected are older Spring Security ...

Authorization

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2019-3778

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

Security Bulletin: Cross-site scripting vulnerability in OAuth ear in WebSphere Application Server (CVE-2018-1794)

Summary There is a potential cross-site scripting vulnerability in the OAuth ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1794 DESCRIPTION: IBM WebSphere Application Server using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embe...

Rockstar Games: Image Injection on /bully/anniversaryedition may lead to OAuth token theft.

In this report, the researcher identified an image injection issue on www.rockstargames.com/bully/anniversaryedition that could be combined with other vulnerabilities to result in sensitive token theft under certain conditions. We resolved the image injection issue, preventing this series of...

Rockstar Games: Image Injection on www.rockstargames.com/screenshot-viewer/responsive/image may allow facebook oauth token theft.

In this report, the researcher identified an image injection vulnerability in our screenshot-viewer utility on rockstargames.com. One of the input parameters utilized was not being properly filtered, and external URLs could be referenced, allowing off-site images to be called. This issue was...

Drupal OAuth & OpenID Connect Login - OAuth2 Client SSO Login - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-016

This module enables you to allow login into the Drupal websites through an external provider over the OAuth 2.0 protocol. The module sets a Drupal variable used for redirection based on unsanitised user input, leading to an Open Redirect vulnerability. It also fails to sanitise user input which i...

Rockstar Games: Image Injection vulnerability affecting www.rockstargames.com/careers may lead to Facebook OAuth Theft

In this report, the researcher demonstrated a method to chain together separate vulnerabilities that, under certain conditions, could cause a user's Facebook Oauth tokens to leak via the Referer header. The specific vulnerability that was addressed in this report was the image injection component...

Rockstar Games: Stealing Facebook OAuth Code Through Screenshot viewer

In this report, the researcher demonstrated a way to combine multiple vulnerabilities to potentially allow an attacker to extract Oauth tokens from a victim's session. This was done by taking advantage of an image injection vulnerability in the Screenshot Viewer utility as well as additional...

Rockstar Games: Facebook OAuth Code Theft through referer leakage on support.rockstargames.com

In this report, the researcher was able to discover a method to expose and exfiltrate Oauth tokens. This was done by injecting an tag containing a payload pointing to the attacker's own domain into replies of Support Community forum threads. Once this was done, users operating under a particular...

Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link. The reported Fortnite...

Fortnite Flaws Allowed Hackers to Takeover Gamers' Accounts

Check Point researchers have discovered multiple security vulnerabilities in Fortnite, a massively popular online battle game, one of which could have allowed remote attackers to completely takeover player accounts just by tricking users into clicking an unsuspectable link. The reported Fortnite...