1207 matches found
CVE-2024-52289 authentik has an insecure default configuration for OAuth2 Redirect URIs
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...
CVE-2024-52289 authentik has an insecure default configuration for OAuth2 Redirect URIs
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...
CVE-2024-52289
This CVE concerns authentik, an open-source identity provider. In the OAuth2 provider, Redirect URIs are validated by a RegEx comparison. If no Redirect URIs are configured for a provider, authentik can automatically treat the first received redirect_uri as allowed, without escaping RegEx-special...
CVE-2024-52289 authentik has an insecure default configuration for OAuth2 Redirect URIs
authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no Redirect URIs are configured in a provider, authentik will automatically use the first redirecturi value received as an allowed redirect URI, without escaping...
ROS-20241121-01
Vulnerability in Moodle virtual learning environment related to excessive data output by application in Messaging error message. Messaging error message. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to confidential information. remotely, to...
Moodle IDOR when deleting OAuth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
GHSA-FHG2-R2H9-H7Q8 Moodle IDOR when deleting OAuth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
CVE-2024-45690
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
CVE-2024-45690 Moodle: idor when deleting oauth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
CVE-2024-45690
CVE-2024-45690 affects Moodle and concerns an IDOR when deleting OAuth2-linked accounts. The connected sources describe a flaw where additional checks are needed to ensure users can only delete their own OAuth2-linked accounts, indicating insufficient authorization checks in the relevant Moodle f...
CVE-2024-45690 Moodle: idor when deleting oauth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
CVE-2024-45690 Moodle: idor when deleting oauth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...
CVE-2024-11483
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...
CVE-2024-11217
CVE-2024-11217 affects the OAuth-server (including oauth-server-container). The vulnerability causes the OAuth2 client secret to be logged when the logLevel is set to Debug or higher for OIDC/GitHub/GitLab/Google IDP logins. Impact is exposure of OAuth2 client secrets via logs (confidentiality ri...
CVE-2024-52519
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgrade...
CVE-2024-52519 Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgrade...
CVE-2024-52519
CVE-2024-52519 affects Nextcloud Server and Nextcloud Enterprise Server. The issue is that OAuth2 client secrets were stored in a recoverable form, enabling an attacker with access to a database backup and the Nextcloud config file to decrypt them. Public documentation in the provided sources rec...
CVE-2024-52519 Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgrade...
CVE-2024-52519 Nextcloud Server's OAuth2 client secrets were stored in a recoverable way
Nextcloud Server is a self hosted personal cloud system. The OAuth2 client secrets were stored in a recoverable way, so that an attacker that got access to a backup of the database and the Nextcloud config file, would be able to decrypt them. It is recommended that the Nextcloud Server is upgrade...
