PT-2026-104580

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.3 Description The OAuth2 Provider PKCE enforcement is only applied to authorization requests where the response type is exactly code. Consequently, codes issued via OpenID Connect hybrid flows such as code token,...

cloudfoundry_uaa

CloudFoundry 사용자 계정 및 인증UAA 서버 UAA는 Cloud Foundry에서 사용되는 멀티 테넌트 ID 관리 서비스이지만, 독립형 OAuth2 서버로도 사용할 수 있습니다. 주요 역할은 OAuth2 공급자로, 클라이언트 애플리케이션이 Cloud Foundry 사용자를 대신하여 작업할 때 사용할 토큰을 발급하는 것입니다. 또한 Cloud Foundry 자격 증명을 사용하여 사용자를 인증할 수 있으며, 해당 자격 증명또는 다른 자격 증명을 사용하여 SSO 서비스로 작동할 수 있습니다. 사용자 계정 관리 및 OAut...

PT-2026-99718

Name of the Vulnerable Software and Affected Versions Nezha version 2.2.3 Description Nezha contains a Host header injection issue in the OAuth2 redirect endpoint. When the optional dashboard host setting is empty, the application reflects the attacker-supplied HTTP Host header into the redirect...

EUVD-2015-9275

Malware in sbrugna...

EUVD-2024-45991

Malicious code in bioql PyPI...

EUVD-2022-4638

Malicious code in bioql PyPI...

CVE-2024-52289

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...

CVE-2015-9435

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...

CVE-2024-52289

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...

CVE-2024-52289: Incorrect Regular Expression

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...

GHSA-MWH9-GR45-XVV4 Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

CVE-2015-9435

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...

Design/Logic Flaw

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...

CVE-2015-9435

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...

CVE-2015-9435

The CVE-2015-9435 entry concerns the WordPress plugin oauth2-provider (before 3.1.5). The vulnerability arises from incorrect generation of random numbers (insecure pseudorandom number generation) in the plugin, as documented across multiple sources. Impact ranges from Partial confidentiality, in...

CVE-2015-9435: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers...

PT-2019-7394

Name of the Vulnerable Software and Affected Versions WordPress oauth2-provider plugin versions prior to 3.1.5 Description The issue is related to the incorrect generation of random numbers in the oauth2-provider plugin for WordPress. Recommendations For versions prior to 3.1.5, update the...

CVE-2019-15630

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow...

Directory traversal

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019, and all versions of MuleSoft API Gateway released before August 1 2019 allow...