1352 matches found
evolution security, bug fix, and enhancement update
evolution 3.28.5-16 - Resolves: 1902630 Crash on file drag into mail composer with WebKitGTK 2.30 3.28.5-15 - Resolves: 1883619 ECalendarItem: Settings loaded only when being shown evolution-data-server 3.28.5-15 - Resolves: 1862403 CVE-2020-16117: Crash on malformed server response with minimal...
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
Impact fosite400 released as v0.30.2 introduced a new feature for handling redirect URLs pointing to loopback interfaces rfc8252section-7.3. As part of that change new behavior was introduced which failed to respect the redirect URL's only for loopback interfaces! query parameters 1. Registering ...
GHSA-RFQ3-W54C-F9Q5 OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
Impact fosite400 released as v0.30.2 introduced a new feature for handling redirect URLs pointing to loopback interfaces rfc8252section-7.3. As part of that change new behavior was introduced which failed to respect the redirect URL's only for loopback interfaces! query parameters 1. Registering ...
OPENSUSE-SU-2021:0675-1 Security update for alpine
This update for alpine fixes the following issues: Update to release 2.24 A few crash fixes Implementation of XOAUTH2 for Yahoo! Mail. Update to release 2.23.2 Expansion of the configuration screen for XOAUTH2 to include username, and tenant. Alpine uses the domain in the From: header of a messag...
Code Injection
Overview oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid...
XML External Entity (XXE)
oauth2-oidc-sdk is vulnerable to XML external entity XXE attacks.The parse function in SAML2AssertionValidator.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...
@abramltd/jwt-oauth2-middleware (0.1.0), @aerocorp/cli (7.0.5) +143 more potentially affected by CVE-2017-18924 via oauth2-server (>=3.0.0, <=3.1.1)
oauth2-server NPM version =3.0.0, =1.0.0, =0.0.1, =2.1.0, =3.0.0, =0.4.1, =0.1.0, =3.0.0, =3.0.0, =3.5.8 and more Source cves: CVE-2017-18924 Source advisory: OSV:GHSA-2FW4-MGQ9-39CX...
Code Injection in oauth2-server
"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...
GHSA-2FW4-MGQ9-39CX Code Injection in oauth2-server
"oauth2-server aka node-oauth2-server through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not...
LY Corporation: Reflected XSS in OAUTH2 login flow (https://access.line.me)
Vulnerability description not provided...
OAuth2 Proxy Access Control Error Vulnerability
OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...
CVE-2021-21411
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...
CVE-2021-21411
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...
Authorization
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...
CVE-2021-21411 Incorrect authorization in OAuth2-Proxy
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...
CVE-2021-21411
OAuth2-Proxy suffered a vulnerability where the --gitlab-group flag for GitLab-group-based authorization stopped working in v7.0.0. Regardless of the flag, authorization wasn’t restricted and an authenticated user’s groups were added to X-Forwarded-Groups upstream. A bug caused the user session’s...
OAuth2-Proxy 访问控制错误漏洞
OAuth2 Proxy is a reverse proxy that provides authentication with Google, Github or other providers. OAuth2 Proxy suffers from an access control error vulnerability that stems from the fact that none of the authorizations are restricted. No details of the vulnerability are available at this time...
PT-2021-14486 · Unknown · Oauth2 Proxy
Name of the Vulnerable Software and Affected Versions: OAuth2-Proxy versions 7.0.0 through 7.0.x Description: The --gitlab-group flag for group-based authorization in the GitLab provider stopped working, allowing any authenticated users to access applications regardless of --gitlab-group membersh...
Open-Xchange: Path Traversal in dict-fs and no-check Escape Character in oauth2-jwt
0x01 Path Traversal in dict-fs module If we use fs to store dictionaries, when program get the value of key: static int fsdictlookupstruct dict dict, poolt pool, const char key, const char valuer, const char errorr struct fsdict dict = struct fsdict dict; struct fsfile file; struct istream input;...