Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params

Impact All versions of Argo CD starting with v0.11.0 is vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or UI. The vulnerabilities are due to the use of insufficiently random values in parameters in Oauth2/OIDC login flows. In each case, using a...

Malicious code in node-upwork-oauth2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f042389769855f94f76780b3ab5957fb065f4bcfe1b005db035b50db1806649 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4892 Malicious code in node-upwork-oauth2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f042389769855f94f76780b3ab5957fb065f4bcfe1b005db035b50db1806649 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in myjohndeereapi-oauth2-nodejs-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8e396af178eba7a59aaabef53f2a909b237f1fbb21b5735f93c3607d5f87421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4765 Malicious code in myjohndeereapi-oauth2-nodejs-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8e396af178eba7a59aaabef53f2a909b237f1fbb21b5735f93c3607d5f87421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mattermost-oauth2-client-sample-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c08d64e4f26feed57b76b4cb919c951c5568bc23b6a1fc9aa0bf328e85f80072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4502 Malicious code in mattermost-oauth2-client-sample-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c08d64e4f26feed57b76b4cb919c951c5568bc23b6a1fc9aa0bf328e85f80072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALPINE-CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

DEBIAN-CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

Authentication flaw

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576: Improper Authentication

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

CVE-2022-22576 is an improper authentication vulnerability in curl 7.33.0 through 7.82.0 that may allow reuse of OAuth2-authenticated connections without confirming the credentials used for the transfer, affecting SASL-enabled protocols (SMPTP(S), IMAP(S), POP3(S), LDAP(S) via OpenLDAP). The root...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

CVE-2022-22576

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...

omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected...

Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...