7244 matches found
PT-2017-13295
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.11 Description The issue is related to the oauth function in the controllers/member/api.php file, which has an XSS vulnerability concerning the Referer HTTP header, specifically with Internet Explorer. Recommendations For...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an...
The bundled Atlassian OAuth plugin allows arbitrary HTTP requests to be proxied - CVE-2017-9506
The version of the bundled Atlassian OAuth plugin was vulnerable to Server Side Request Forgery SSRF. This allowed a XSS and or a SSRF attack to be performed. More information about the Atlassian OAuth plugin issue see https://ecosystem.atlassian.net/browse/OAUTH-344 . When running in an...
Mautic SSO/OAuth2 Plugin Cross-Site Request Forgery Vulnerability
Mautic is an open source marketing automation management software developed and maintained by the Mautic community. The software has features such as monitoring websites, creating web pages and sending emails.Mautic SSO/OAuth2 is one of the single sign-on plug-ins based on the OAuth2 a secure log...
Server side request forgery (ssrf)
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
CVE-2017-9506
CVE-2017-9506 affects Atlassian Jira/Confluence/etc. OAuth Plugin IconUriServlet. Versions 1.3.0–1.9.11 and 2.0.0–2.0.3 are vulnerable to SSRF and cross-site scripting via the IconUriServlet, enabling access to internal network resources and potential CSRF-style effects. The issue is fixed in 1.9...
CVE-2017-9506
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
PT-2017-18975
Name of the Vulnerable Software and Affected Versions Atlassian OAuth Plugin versions 1.3.0 through 1.9.11 Atlassian OAuth Plugin versions 2.0.0 through 2.0.3 Description The issue allows remote attackers to access internal network resources and/or perform an XSS attack via Server Side Request...
CVE-2017-9506: Server-Side Request Forgery (SSRF)
The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery SSRF...
PT-2017-6616
Name of the Vulnerable Software and Affected Versions Accellion File Transfer Appliance versions prior to FTA 9 11 210 Description The issue allows remote attackers to execute arbitrary code via shell metacharacters in the oauth token parameter. Recommendations For Accellion File Transfer Applian...
PT-2017-7309
Name of the Vulnerable Software and Affected Versions MediaWiki OAuth extension affected versions not specified Description The issue concerns the OAuth extension for MediaWiki, where it improperly negotiates a new client token. This allows attackers to bypass intended IP address access...
CVE-2015-2675
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the restproxycallgeturl function, which allows remote attackers to cause a denial of service application crash via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interfa...
Design/Logic Flaw
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the restproxycallgeturl function, which allows remote attackers to cause a denial of service application crash via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interfa...
CVE-2015-2675
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the restproxycallgeturl function, which allows remote attackers to cause a denial of service application crash via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interfa...
CVE-2015-2675
The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the restproxycallgeturl function, which allows remote attackers to cause a denial of service application crash via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interfa...