CVE-2022-36087

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

RHEL 8 : Red Hat OpenShift Service Mesh 2.1.3 (RHSA-2022:5004)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:5004 advisory. Red Hat OpenShift Service Mesh is a Red Hat distribution of the Istio service mesh project, tailored for installation into an on-premise...

Microsoft will disable Basic authentication for Exchange Online in less than a month

Microsoft has posted a reminder on the Exchange Team blog that Basic authentication for Exchange Online will be disabled in less than a month, on October 1, 2022. The first announcement of the change stems from September 20, 2019. With so much warning you might expect organizations to be ready, a...

CVE-2022-2083

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site...

CVE-2022-2083

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site...

CVE-2022-2083

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site...

CVE-2022-2083

CVE-2022-2083 affects the WordPress plugin “Simple Single Sign On”

CVE-2022-2083 Simple Single Sign On <= 4.1.0 - Authentication Bypass

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site...

OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The plugin does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address POST / HTTP/1.1...

OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

The plugin does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address PoC POST / HTTP/1.1...

CVE-2022-2403

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by...

CVE-2022-2403

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by...

PT-2022-16424 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform affected versions not specified Description: A credentials leak was found in the OpenShift Container Platform, where the private key for the external cluster certificate was stored incorrectly in the...

Exploit for SQL Injection in Casbin Casdoor

Preface Casdoor is a centralized Single Sign-On SSO authent...

GHSA-4RG6-FM25-GC34 oauth2-server through 3.1.1 vulnerable to Open Redirect

In oauth2-server aka node-oauth2-server through 3.1.1, the value of the redirecturi parameter received during the authorization and token request is checked against an incorrect URI pattern a-zA-Za-zA-Z0-9+.-+: before making a redirection. This allows a malicious client to pass an XSS payload...

CVE-2022-2569

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users...

Information disclosure

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users...

CVE-2022-2569 ARC Informatique PcVue

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users...

CVE-2022-2569 ARC Informatique PcVue

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users...

CVE-2022-2569

This CVE (CVE-2022-2569) affects ARC Informatique PcVue (OAuth Web Service configuration) components: PcVue 12 (before 12.0.27) and PcVue 15 (before 15.2.3). The vulnerability stems from cleartext storage of sensitive information, potentially allowing an authenticated user to access session data ...