217 matches found
GHSA-CF36-985G-V73C omniauth-facebook Cross-Site Request Forgery vulnerability
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
Cross-Site Request Forgery (CSRF) Via Leakage Of Authenticity Token
omniauth is susceptible to cross-site request forgery attacks. The attacks are possible because it stores POST parameters in addition to GET parameters in callback phase, thereby exposing authenticitytokens from the POST parameters and leading to bypass of cross-site request forgery protection...
omniauth leaks authenticity token in callback params
In strategy.rb in OmniAuth before 1.3.2, the authenticitytoken value is improperly protected because POST in addition to GET parameters are stored in the session and become available in the environment of the callback phase...
OmniAuth Request Phase Cross-Site Request Forgery Vulnerability
OmniAuth is a set of authentication system implemented using Rack middleware. OmniAuth suffers from a cross-site request forgery vulnerability. As the program fails to properly validate HTTP requests. A remote attacker can exploit this vulnerability to perform unauthorized operations and gain...
CSRF vulnerability in OmniAuth's request phase
The request phase of the OmniAuth Ruby gem is vulnerable to Cross-Site Request Forgery CSRF when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into...
CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
Cross site request forgery (csrf)
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
CVE-2013-4562
The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...
omniauth-facebook Gem for Ruby Insecure Access Token Handling Authentication Bypass
omniauth-facebook Gem for Ruby contains a flaw that is due to the application supporting passing the access token via the URL. This may allow a remote attacker to bypass authentication and authenticate as another user...
omniauth-facebook Gem for Ruby Unspecified CSRF
omniauth-facebook Gem for Ruby contains a flaw as HTTP requests do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site...
CVE-2012-6134
Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...
CVE-2012-6134
Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...
CVE-2012-6134
CVE-2012-6134: CSRF vulnerability in the Ruby gem omniauth-oauth2 (versions 1.1.1 and earlier) allows remote attackers to hijack user authentication for requests that modify session state. Affected component is the omniauth-oauth2 gem for Ruby; root cause is cross-site request forgery. Connected ...
CVE-2012-6134
Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...