CVE-2020-26938

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern "a-zA-Za-zA-Z0-9+.-+:" before making a redirection. This allows a malicious client to pass an XSS payload...

Authorization

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern "a-zA-Za-zA-Z0-9+.-+:" before making a redirection. This allows a malicious client to pass an XSS payload...

CVE-2020-26938

CVE-2020-26938 affects oauth2-server/node-oauth2-server

CVE-2020-26938

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern "a-zA-Za-zA-Z0-9+.-+:" before making a redirection. This allows a malicious client to pass an XSS payload...

oauth2-server 输入验证错误漏洞

oauth2-server is a standards-compliant implementation of OAuth 2.0 authorization server written in PHP for individual developers . Provides authentication and authorization features for applications to protect API security. A security vulnerability exists in oauth2-server node-oauth2-server versi...

PT-2022-8851 · Unknown · Oauth2-Server

Name of the Vulnerable Software and Affected Versions: oauth2-server aka node-oauth2-server versions 3.1.1 and earlier Description: The issue arises from an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: used to check the redirect uri parameter during authorization and token requests. This flaw allow...

EulerOS 2.0 SP10 : curl (EulerOS-SA-2022-2153)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2022-2128)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2022-2153)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Spring Authorization Server Is Going 1.0

We are excited to announce that weve started preparing for Spring Authorization Server 1.0 with plans to release the GA version in November 2022. It has been just over two years since we initially announced this new project, and we have come a long way since its initial development. The project h...

CVE-2022-34839

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin = 1.0.1 at WordPress...

Authentication flaw

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin = 1.0.1 at WordPress...

CVE-2022-34839 WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin = 1.0.1 at WordPress...

CVE-2022-34839 WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin = 1.0.1 at WordPress...

CVE-2022-34839

CVE-2022-34839 describes an Authentication Bypass in CodexShaper’s WP OAuth2 Server plugin for WordPress, affecting versions

PT-2022-22388 · Codexshaper · Wp Oauth2 Server

Name of the Vulnerable Software and Affected Versions: CodexShaper's WP OAuth2 Server plugin versions = 1.0.1 Description: The issue is related to an Authentication Bypass vulnerability. It affects the WP OAuth2 Server plugin at WordPress. Recommendations: For CodexShaper's WP OAuth2 Server plugi...

This Week in Spring - July 19th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! This week Im trying to wind down some threads and take some vacation with my family. Its going to be an amazing time, indeed! But that doesnt stop the deluge of novelties and news in the wide world of Springdom, so weve got a...

WordPress WP OAuth2 Server plugin <= 1.0.1 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Lana Codes in WordPress WP OAuth2 Server plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 23, 2022 and is not available for download. This closure is temporary, pending a full review...

GHSA-QWRJ-9HMP-GPXH FlyteAdmin Insufficient AccessToken Expiration Check

Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...

FlyteAdmin Insufficient AccessToken Expiration Check

Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...