CVE-2015-1885

CVE-2015-1885 affects IBM WebSphere Application Server: vulnerable when OAuth password grant is used. Affects WebSphere Application Server Full/Profile: 8.5 (Liberty 8.5) up to 8.5.5.x, 8.0 up to 8.0.0.10, and 7.0 up to 7.0.0.38/39. Root cause: OAuth ear (WebSphereOauth20SP.ear) handling allows p...

CVE-2015-1885

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

PT-2015-5485

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server WAS versions 7.0 through 7.0.0.38 IBM WebSphere Application Server WAS versions 8.0 through 8.0.0.10 IBM WebSphere Application Server WAS 8.5 Liberty Profile versions prior to 8.5.5.5 IBM WebSphere Application...

CVE-2015-1885: Undefined Security Weakness

WebSphereOauth20SP.ear in IBM WebSphere Application Server WAS 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vecto...

Shopify: Open redirection in OAuth

Hello, When we specify an invalid scope then the authorize url redirects to the site mentioned in redirecturi. So, attacker can create an app and use it as open redirector to redirect victims to fake sites. eg. Attacker can host same phishing page and hack the victims. Proof Of Concept :...

Open redirect in rfc6749 aka 'The OAuth 2.0 Authorization Framework'

!Image result for meme all the...

Internet Bug Bounty: Race Conditions in OAuth 2 API implementations

Most of OAuth 2 API implementations seem to have multiple Race Condition vulnerabilities for processing requests for Access Token or Refresh Token. Race Condition allows a malicious application to obtain several accesstoken and refreshtoken pairs while only one pair should be generated. Further, ...

Synology.com Cross Site Scripting

Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS RXSS Date: 03/04/2014 Author: Yann CAM @ Synetis - ASafety Vendor or Software Link: www.synology.com Version: / Category: Reflected Cross Site Scripting Google dork: Tested on: Synology.com update sub-domain Synology description ...

Dropbox SDK for Android account spoofing

It's possible to spoof account via OAuth...

Android DropBox SDK Vulnerability, CVE-2 0 1 4-8 8 8 9 analysis-vulnerability warning-the black bar safety net

Today, personal data are stored in the cloud, which makes it like a photo backup or General storage as service can not only be accessed by the user, can also be representative of the user of the app the access. In many ways, including access to the control functions of the app and the service...

The Dropbox SDK, there is a remote exploit, has been an emergency fix-bug warning-the black bar safety net

! The Dropbox developers recently fixed the Android version of the Dropbox SDK to store the application on a remote exploitation vulnerability, an attacker exploit the vulnerability without user consent directly to the app and the Dropbox account is connected. As long as the user installed...

OAuth Hacks A gentle introduction to OAuth 2 and Apache Oltu

Here I posted the slides of the JUG event in Basel. I have been kind of quiet lately in this space. I have a couple on vulnerabilities outstanding one OAuth related and one browser related. Waiting for the green light... stay tuned...

Dropbox Patches Remotely Exploitable Vulnerability in SDK

Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the storage app that enabled attackers to connect applications to a Dropbox account without the user’s consent. This could have opened users up to the theft of information from any app that use...

Design/Logic Flaw

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

CVE-2014-7922

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

CVE-2014-7922

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

CVE-2014-7922

CVE-2014-7922 involves the GoogleAuthUtil.getToken method in the Google Play services SDK prior to 2015. The vulnerability arises when the code sets parameters in OAuth token requests after detecting a corresponding opt parameter in the Bundle extras argument, enabling a crafted application to by...

CVE-2014-7922: Undefined Security Weakness

The GoogleAuthUtil.getToken method in the Google Play services SDK before 2015 sets parameters in OAuth token requests upon finding a corresponding opt parameter in the Bundle extras argument, which allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scop...

PT-2015-3957

Name of the Vulnerable Software and Affected Versions Google Play services SDK versions prior to 2015 Description The issue allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes, including the SID and LSID scopes, by setting specific parameters in...

Coinbase: open authentication bug

Hi, If developer registers one of the three url's with out http protocol ex:example.com in oauth registration then he would be redirected to www.coinbase.comexample.com.This makes the user to redirect to another site than the real application.Attacker could take advantage of this and steal the...