CVE-2019-13497

CVE-2019-13497 漏洞标题：跨站请求伪造（CSRF） 日期：07/10/2019 漏洞作者：Furqan Khan 厂商主页：https://www.oneidentity.com/ 软件链接：https://www.oneidentity.com/products/cloud-access-manager/ 版本：8.1.3 测试环境：Kali Linux、Windows 7、Ubantu 16.04 要利用此漏洞，攻击者只需创建一个用于提交注销请求的 HTML 表单，并将链接分享给受害者。受害者点击该链接后，注销请求将在后台触发，从而使受害者从其有效会话中注销并退出网站。...

CVE-2025-59363

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

CVE-2025-59363: Incorrect Resource Transfer Between Spheres

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

CVE-2025-59363

In One Identity OneLogin prior to 2025.3.0, the GET /api/2/apps endpoint returned OIDC client_secret values alongside app metadata, enabling disclosure of sensitive credentials. This is caused by excessive data being returned by the Apps API v2 and constitutes a breach of confidentiality for OIDC...

Exploit for Cross-Site Request Forgery (CSRF) in Oneidentity Cloud_Access_Manager

CVE-2019-13497 Exploit Title: Cross Site Request Forgery CSR...

Exploit for Improper Validation of Integrity Check Value in Oneidentity Cloud_Access_Manager

CVE-2019-13496 Exploit Title: OTP bypass Filed Integrity ch...

Exploit for Cleartext Transmission of Sensitive Information in Oneidentity Cloud_Access_Manager

CVE-2019-13498 Exploit Title: MITM - Missing HSTS causing cre...