Security Bulletin: Cross-site scripting vulnerability in Liberty for Java for IBM Bluemix (CVE-2016-0283)

Summary There is a cross-site scripting vulnerability in Liberty for Java for IBM Bluemix when using the OpenID Connect OIDC client. Vulnerability Details CVEID: CVE-2016-0283 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting in the OIDC client web application...

How To Deploy NetScaler as Both OAuth SP and IdP

Deploying the NetScaler, as both an OAuth Service Provider SP and IdP Identity Provider or OpenID Authenticator. This can be on the same NetScaler, or on two separate appliances...

ownCloud 'OpenID' Access Control Bypass Vulnerability - Windows

ownCloud is prone to an access control bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud 'OpenID' Access Control Bypass Vulnerability - Linux

ownCloud is prone to an access control bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

ownCloud Server user_openid Security Bypass Vulnerability

ownCloud is a free and open source personal cloud storage solution from the German company ownCloud, which provides file management, music storage, calendaring, etc. ownCloud Server is a server version. useropenid app is one of the user ID acquisition apps. A security vulnerability exists in the...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

Information disclosure

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

CVE-2014-2048

The useropenid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation...

Authentication flaw

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token...

CVE-2015-6926

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token...

CVE-2015-6926

The vulnerability CVE-2015-6926 affects the OpenID Single Sign-On authentication in OXID eShop (pre-4.5.0). A crafted authentication token that includes a user email enables remote attackers to impersonate legitimate users. Documents from NVD, GHSA, OSV, CNVD/CNVD-like sources consistently descri...

Cross-site Scripting (XSS)

cloudfoundry-identity-uaa is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary Javascript through the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint...

CVE-2018-1190

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting XSS attack is possible in the clientId parameter of a request...

CVE-2018-1190

An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting XSS attack is possible in the clientId parameter of a request...

CVE-2018-1190: XSS on UAA OpenID Connect check session iframe endpoint | Cloud Foundry

Severity Medium Vendor VMware Cloud Foundry Affected VMware Products and Versions Severity is medium unless otherwise noted. cf-release: All versions prior to cf-release v270 cf-deployment: No versions of cf-deployment are affected UAA release: v3.x prior to v3.20.2 UAA bosh release uaa-release:...

Man-in-the-Middle (MitM)

python-openid is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the usage of urllib2 which does not perform the verification of SSL Certificates. This defeats the purpose of SSL Certificates, allowing tampered connections to succeed and to happen unnoticed...

Denial Of Service (DoS)

python-openid is vulnerable to Denial of Service DoS attacks. The vulnerability exists due to the usage of an insecure Yardis XRDS parser which contains a series of weaknesses that allows XML attacks such as the Billion Laugh attack...

GHSA-6C8P-QPHV-668V Denial of service in ruby-openid

The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service CPU consumption via 1 a large XRDS document or 2 an XML Entity Expansion XEE attack...