Atlassian Application Links OAuth status rest resource Cross-Site Request Forgery Vulnerability

Atlassian Application Links is a plugin from Atlassian Australia for creating buttons in Atlassian products to connect to other applications.OAuth status rest resource is one of the OAuth status resource packages. A cross-site request forgery vulnerability exists in the OAuth status rest resource...

March 13, 2018—KB4088787 (OS Build 14393.2125 and 14393.2126)

None None...

UBUNTU-CVE-2018-1082

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site...

Server side request forgery (ssrf)

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery SSRF by creating an OAut...

CVE-2017-18096

The CVE concerns Atlassian Application Links: the OAuth status REST resource is affected in versions before 5.2.7, 5.3.0 before 5.3.4, and 5.4.0 before 5.4.3. A remote attacker with administrative rights can trigger a Server Side Request Forgery by creating an OAuth application link to a controll...

ning.com XSS vulnerability

Open Bug Bounty ID: OBB-596519 Description| Value ---|--- Affected Website:| ning.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FreeBSD : moodle -- multiple vulnerabilities (cdb4d962-34f9-11e8-92db-080027907385)

moodle reports : Unauthenticated users can trigger custom messages to admin via paypal enrol script. Suspended users with OAuth 2 authentication method can still log in to the site. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...

CVE-2017-0926

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

Authorization

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

CVE-2017-0926

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

CVE-2017-0926

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

CVE-2017-0926

GitLab Community Edition 10.3 is affected by an improper authorization in the Oauth sign-in component, enabling unauthorized user login. Root cause: OAuth sign-in bypass allows login without proper authorization. Impact: unauthorized access via OAuth flow with partial/ high impact credentials (pe...

CVE-2017-0926

Removed by vendor...

CVE-2017-0926

Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthorized user login...

Debian DSA-4145-1 : gitlab - security update

Several vulnerabilities have been discovered in Gitlab, a software platform to collaborate on code : - CVE-2017-0915/ CVE-2018-3710 Arbitrary code execution in project import. - CVE-2017-0916 Command injection via Webhooks. - CVE-2017-0917 Cross-site scripting in CI job output. - CVE-2017-0918...

U.S. Dept Of Defense: SSRF on █████████ Allowing internal server data access

Summary: An end point on ██████ allows an internal access to the network thus revealing sensitive data and allowing internal tunneling Description: OAuth Plugin allows you to provide a url that gives a snap shot of the web page. We can pass internal URLS and conduct SSRF. Impact Critical...

moodle -- multiple vulnerabilities

moodle reports: Unauthenticated users can trigger custom messages to admin via paypal enrol script. Suspended users with OAuth 2 authentication method can still log in to the site...