5180 matches found
Fedora Update for mod_auth_openidc FEDORA-2019-a25d5df3b4
The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
NewStart CGSL CORE 5.05 / MAIN 5.05 : mod_auth_openidc Multiple Vulnerabilities (NS-SA-2019-0243)
The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has modauthopenidc packages installed that are affected by multiple vulnerabilities: - The OpenID Connect Relying Party and OAuth 2.0 Resource Server aka modauthopenidc module before 2.1.6 for the Apache HTTP Server does not sk...
Vercel: through %09 Character the attacker is able to steal Github Token [ Account Takeover ]
Summary: Hello i've found the filter will deleted this %09 character when checking the value parameter next in oauth which allow to attacker to bypass Filter and steal Oauth Token of user thats lead to account takeover ! Steps To Reproduce: 1. Go To...
CVE-2013-4120
Katello has a Denial of Service vulnerability in API OAuth authentication...
Authentication flaw
Katello has a Denial of Service vulnerability in API OAuth authentication...
CVE-2013-4120
Katello has a Denial of Service vulnerability in API OAuth authentication...
CVE-2013-4120
CVE-2013-4120 pertains to Katello with a Denial of Service vulnerability in the API OAuth authentication mechanism. The initial sources describe a DoS condition without detailing specific vulnerable versions, affected modules, or exact root cause. The CVSS metrics included show a network-exposed,...
Polymail, Inc.: Bug in OAuth Success Redirect URI Validation
@bluebert discovered a bug on the OAuth login endpoint that allows creation of OAuth login urls with Polymail as the subdomain on external domains. This has now been fixed. A bug in how OAuth login URLs were generated in particular, of the redirect URI allowed for an attacker to steal secrets...
Cross-Site Request Forgery (CSRF)
auth0-aspnet and auth0-aspnet-owin is vulnerable to cross-site request forgery CSRF. The lack of use and verification of the state parameter in OAuth 2.0 and OpenID Connect protocols, which prevented the application from verifying the authenticity of requests, allows an attacker to inject their...
Microsoft OAuth Flaw Opens Azure Accounts to Takeover
A vulnerability in the way Microsoft applications use OAuth for third-party authentication could allow an attacker to take over Azure cloud accounts. OAuth is a protocol that allows app users to share data about their accounts with third-party websites or apps, so that when they sign into the app...
New Facebook Tool Let Users Transfer Their Photos and Videos to Google
Facebook has finally started implementing the open source data portability framework as the first phase of 'Data Transfer Project,' an initiative the company launched last year in collaboration with Google, Apple, Microsoft, and Twitter. Facebook today announced a new feature that will allow its...
NewStart CGSL CORE 5.04 / MAIN 5.04 : mod_auth_openidc Multiple Vulnerabilities (NS-SA-2019-0220)
The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has modauthopenidc packages installed that are affected by multiple vulnerabilities: - The OpenID Connect Relying Party and OAuth 2.0 Resource Server aka modauthopenidc module before 2.1.6 for the Apache HTTP Server does not sk...
Authentication flaw
An issue was discovered in Cloudera Hue 6.0.0 through 6.1.0. When using one of following authentication backends: LdapBackend, PamBackend, SpnegoDjangoBackend, RemoteUserDjangoBackend, SAML2Backend, OpenIDBackend, or OAuthBackend, external users are created with superuser privileges...
Moodle < 3.5.9, 3.6.x < 3.6.7, 3.7.x < 3.7.3 Multiple Vulnerabilities
Moodle is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Shopify: Shopify Stocky App OAuth Misconfiguration
@vulnh0lic noticed that a staff member without Apps permission was able to access the Stocky app. We determined that this was because of a bug in Stocky's OAuth authentication code, which allowed the user to be granted access to Stocky at the start of the OAuth process rather than the end. This...
Picsart: User account compromised authentication bypass via oauth token impersonation
OAuth token impersonation is actually a bug when 3rd party company app or malicious app collects the access token of the same user then that company can access to user account on PicsArt. The condition is that the user needs to authorized both PicsArt and malicious app with same Facebook or Googl...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.2.4 oauth-server-container security update
An update for oauth-server-container is now available for Red Hat OpenShift Container Platform 4.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...
Genasys Technologies: Ability to bypass social OAuth and take over any account [d2c-api]
Summary: An attacker is able to login to any email account that doesn't belong to him through using the OAuth functionality https://staging.genasystech.co.uk/d2c-api/v1/account/login/provider Steps To Reproduce: 1. Register an account with an email and verify it using the one time code that is...
Unspecified Vulnerability in CloudBees Jenkins Bitbucket OAuth Plugin
CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . Bitbucket OAuth Plugin is used in which a...
