2123 matches found
Open Redirector in spring-security-oauth2
Spring Security OAuth, versions 2.3 prior to 2.3.5 , and 2.2 prior to 2.2.4 , and 2.1 prior to 2.1.4 , and 2.0 prior to 2.0.17 , and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request t...
Cross site scripting
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
CVE-2019-8400
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
CVE-2019-8400
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
CVE-2019-8400
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
CVE-2019-8400
ORY Hydra before v1.0.0-rc.3+oryOS.9 is affected by a Reflected XSS vulnerability in the oauth2/fallbacks/error error_hint parameter. The issue allows injection of arbitrary script via that parameter. No exploitation status or mitigations are provided in the excerpt; refer to the CVE entry and li...
CVE-2019-8400
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
CVE-2019-8400: Improper Neutralization of Input During Web Page Generation
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...
Nonce Values Unchecked
python-oauth2 is vulnerable to replay attacks. This vulnerability is caused in the Server.verifyrequest function where it does not check the nonce value, allowing remote attackers to perform replay attacks through a signed URL...
Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
GHSA-4RM3-4MQ4-MFWR Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
Cross site request forgery (csrf)
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
CVE-2018-20595
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
CVE-2018-20595
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
CVE-2018-20595
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
CVE-2018-20595
Summary: The CSRF vulnerability CVE-2018-20595 affects hsweb 3.0.4 in the file web/authorization/oauth2/controller/OAuth2ClientController.java. The issue arises because the request’s state parameter is not compared against the session’s state parameter after successful authentication, enabling po...
Authorization Bypass
spring-security-oauth2-jose is vulnerable to authorization bypass attacks. The vulnerability exists during JWT issuer validation, and is only affected if the same private key for the issuer and the attacker are used when signing JWTs...
Zomato: [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider
Heyy there, I have found a xss in auth2.zomato.com Full url:https://auth2.zomato.com/oauth2/fallbacks/error?error=xss&errordescription=xss&errorhint=xss Vulnerable Parameters: All available parameters are vulnerable XSS Payload: XSS Steps To Reproduce the xss Just copy paste and load this url in...
Information Disclosure
omniauth-oauth2 is vulnerable to information disclosure. An insecure string comparison is used to verify the anti-CSRF string, allowing for an attacker to enumerate the anti-CSRF string through a timing attack...
Security update for MozillaThunderbird (important)
This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues. Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading...