1354 matches found
Design/Logic Flaw
In Hydra an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go, before version 1.4.0+oryOS.17, when using client authentication method 'privatekeyjwt' 1, OpenId specification says the following about assertion jti: "A unique identifier for the token, which can be used to...
CVE-2020-5300
Hydra (Go-based OAuth2/OpenID provider) before version 1.4.0+oryOS.17 is affected when using client authentication with private_key_jwt because it does not enforce uniqueness of the JWT jti value, enabling potential token replay within the token’s expiry window. A patch is published in v1.4.0+ory...
CVE-2020-5300 Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra
In Hydra an OAuth2 Server and OpenID Certified™ OpenID Connect Provider written in Go, before version 1.4.0+oryOS.17, when using client authentication method 'privatekeyjwt' 1, OpenId specification says the following about assertion jti: "A unique identifier for the token, which can be used to...
oauth2.vademecum.es Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1124823 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
CVE-2019-19381
oauth/oauth2/v1/saml/ in Abacus OAuth Login 201901r4201910210000 before prior to R4 20.11.2019 Hotfix allows Reflected Cross Site Scripting XSS via an error message...
Cross-Site Request Forgery (CSRF)
cloud foundry uaa is vulnerable to cross-site request forgery CSRF. The vulnerability exists as the OAuth2 state parameter is not being validated in the callback function when authenticating with external identity providers...
CVE-2020-5402
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
Design/Logic Flaw
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402
The CVE-2020-5402 issue affects Cloud Foundry UAA (and related deployments) where versions prior to 74.14.0 allow CSRF via the OAuth2 state parameter not being validated in the external identity provider callback. The core vulnerability is a missing check in the callback flow, impacting authentic...
CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402: UAA fails to check the state parameter when authenticating with external IDPs | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Affected Cloud Foundry Products...
omniauth-weibo-oauth2 gem for Ruby Code Execution Vulnerability
The omniauth-weibo-oauth2 gem for Ruby is a Ruby-based authentication package. A security vulnerability exists in the omniauth-weibo-oauth2 gem for Ruby version 0.4.6 deployed on RubyGems.org. An attacker can exploit the vulnerability to execute code...
Buffer overflow
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...
CVE-2019-17268
The CVE-2019-17268 entry concerns the Ruby gem omniauth-weibo-oauth2.0.4.6 distributed on RubyGems.org, which contains a code-execution backdoor inserted by a third party. The vulnerability affects version 0.4.6; versions through 0.4.5, and 0.5.1 and later, are unaffected. The root cause is malic...
Nextcloud Server < 12.0.8, < 13.0.3 Improper Input Vulnerability (NC-SA-2018-003)
Nextcloud Server is prone to an improper input vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
OAuth2 Proxy Open Redirect Vulnerability
OAuth2 Proxy is an OAuth2 proxy service program. OAuth2 Proxy has an input validation vulnerability that can be exploited by remote attackers to submit malicious URIs and trick users into parsing them, which can be used to perform redirection attacks, hijack sessions by obtaining sensitive...