CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

Design/Logic Flaw

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

Design/Logic Flaw

cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...

CVE-2019-14408

CVE-2019-14408 affects cPanel before 78.0.2. Affected component: the web-based cPanel interface; root cause described as an input validation issue that allows a demo account to link with an OpenID provider (SEC-460). Consequence: sanctioned links to an OpenID provider by a non-privileged/demo acc...

CVE-2019-14408

cPanel before 78.0.2 allows a demo account to link with an OpenID provider SEC-460...

CVE-2019-14407

CVE-2019-14407 affects cPanel before 78.0.2, where internal data is disclosed to OpenID providers (SEC-415). Public sources (NVD, Red Hat, CNVD) confirm that versions prior to 78.0.2 are affected and describe an information-disclosure vulnerability tied to configuration/operation errors. The prac...

CVE-2019-14407

cPanel before 78.0.2 reveals internal data to OpenID providers SEC-415...

DEBIAN-CVE-2019-1010247

ZmartZone IAM modauthopenidc 2.3.10.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/modauthopenidc.c, Line: 3109. The fixed version is: 2.3.10.2...

Authentication Bypass

openid is vulnerable to authentication bypass which can be exploitable remotely depending on the way the OpenID integration is performed. The risk can be higher if the integration is done fully based on the example app provided by the project...

ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible...

GHSA-FQFJ-CMH6-HJ49 ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible...

ruby-openid SSRF via claimed_id request

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

Design/Logic Flaw

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

DEBIAN-CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

UBUNTU-CVE-2019-11027

Ruby OpenID aka ruby-openid through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developer...

CVE-2019-11027

Ruby OpenID (ruby-openid) up to version 2.8.0 contains a remote SSRF vulnerability in the OpenID discovery/verification flow. Exploitation could cause the server to connect to an attacker-controlled URL, potentially leaking private information. Public advisories describe impact as remote, with hi...