CVE-2013-4593

CVE-2013-4593 concerns the RubyGem omniauth-facebook. The connected sources describe a flaw where the access token can be transmitted via the URL, enabling a remote attacker to bypass authentication and impersonate another user. This results in an authentication bypass vulnerability within the om...

CVE-2013-4593: Improper Authentication

RubyGem omniauth-facebook has an access token security vulnerability...

PT-2019-6955

Name of the Vulnerable Software and Affected Versions omniauth-facebook affected versions not specified Description The RubyGem omniauth-facebook has an access token security issue. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

Cross-site Scripting (XSS)

devisetokenauth is vulnerable to cross-site scripting XSS. The vulnerability exists as the omniauth failure endpoint is vulnerable through the message parameter...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

Cross site scripting

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

CVE-2019-16751

Devise Token Auth (through 1.1.2) is affected by a Reflected XSS in the omniauth failure endpoint, specifically via the message parameter in the fallback_render method of the omniauth callbacks controller. Unauthenticated attackers can craft a URL to execute malicious JavaScript in a victim’s bro...

CVE-2019-16751: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting XSS through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects...

Discourse < 2.4.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities including CSRF flaws. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-94HM-8Q65-RMXM OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

GHSA-WW4X-RWQ6-QPGF OmniAuth Ruby gem Cross-site Request Forgery in request phase

The request phase of the OmniAuth Ruby gem 1.9.2 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

OmniAuth Ruby gem Cross-site Request Forgery in request phase

The request phase of the OmniAuth Ruby gem 1.9.2 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

Cross-Site Request Forgery (CSRF)

omniauth is vulnerable to cross-site request forgery CSRF. The request phase does not verify the authenticity of client requests, which allows a remote attacker to gain full access to a user's account on a site that uses OmniAuth when used in combination with another CSRF vulnerability on the sid...

CVE-2015-9284

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

CVE-2015-9284

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

Cross site request forgery (csrf)

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

DEBIAN-CVE-2015-9284

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...