Cross site scripting

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...

CVE-2019-19336

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...

CVE-2019-19336

CVE-2019-19336 affects oVirt-engine (OAuth authorization endpoint); the vulnerability is a reflected XSS via the response_type parameter, enabling script execution in a user’s session. Affected versions before 4.3.8 are vulnerable. Remediation: update to 4.3.8 or later (per initial description). ...

PT-2020-10139

Name of the Vulnerable Software and Affected Versions oVirt-engine versions prior to 4.3.8 Description A cross-site scripting issue was reported in the OAuth authorization endpoint. The flaw occurs because URL parameters are included in the HTML response without proper escaping, allowing an...

CVE-2019-19336: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...

The vulnerability of the OAuth2 extension for the software environment used to implement the MediaWiki hypertext environment allows a hacker to perform cross-site request forgeing attacks.

The vulnerability of the OAuth2 extension for implementing the MediaWiki hypertext environment is related to the absence of a check on the OAuth2 status parameter in the callback function. Exploiting this vulnerability allows a malicious actor to perform cross-site forged requests...

PlayStation: Access token stealing.

Summary: https://my.playstation.com/auth/response.html suffers from a misconfiguration which leads to access token stealing. Description: The page...

Abacus OAuth Login Cross-Site Scripting Vulnerability

Abacus OAuth Login is a single sign-on software from Abacus Switzerland. A cross-site scripting vulnerability exists in oauth/oauth2/v1/saml/ in version 201901r4201910210000 prior to Abacus OAuth Login R4 20.11.2019 Hotfix, which can be exploited by an attacker to execute JavaScript code in a...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

Cross site scripting

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19381

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

CVE-2019-19381

Affected product: Abacus OAuth Login. Vulnerable component: oauth/oauth2/v1/saml/ handling. Root cause: reflected XSS triggered by error message in the login flow for version 2019_01_r4_20191021_0000 prior to R4. Impact: could allow execution of JavaScript in a user’s browser (client-side impact)...

PT-2020-10151

Name of the Vulnerable Software and Affected Versions Abacus OAuth Login versions 2019 01 r4 20191021 0000 through prior to R4 20.11.2019 Hotfix Description The issue allows Reflected Cross Site Scripting XSS via an error message. This occurs in the "oauth/oauth2/v1/saml/" endpoint. Recommendatio...

CVE-2019-19381: Improper Neutralization of Input During Web Page Generation

oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...

Fixes redirect uri validation in oauth

More info at https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0...

Rockstar Games: Referer Leakge in language changer may lead to FB token theft.

In this report, the researcher identified a CSRF vulnerability in the language changing function on https://www.rockstargames.com/GTAOnline/ that could be combined with other vulnerabilities to result in sensitive token theft such as Oauth tokens. This vulnerability would be triggered when changi...

Information Disclosure

react-oauth-flow is vulnerable to information disclosure. The vulnerability exists as it stores secrets in the front-end instead of using a properly implemented OAuth client...

@gsandf/react-native-oauth (>=2.1.16, <=2.2.2), react-native-oauth (>=1.1.0, <=2.2.0) +5 more potentially affected by CVE-2019-10805 via valib (2.0.0)

valib NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on valib and may be impacted: - @gsandf/react-native-oauth =2.1.16, =1.1.0, =2.1.16, =2.1.15, =0.1.0, =0.4.6 Source cves: CVE-2019-10805 Source advisory: SNYK:JS-VALIB-559015...

Improper Authorization

Overview All versions of react-oauth-flow fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials. Recommendatio...