Authorization

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to th...

CVE-2018-16493

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

Path traversal

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

CVE-2018-16493

CVE-2018-16493 is a path traversal flaw in the Node.js static-resource-server module (v1.7.2) that allows an unauthenticated attacker to read arbitrary files by crafting URL path traversals (e.g., /../). The NVD lists a high CVSSv3 base score of 7.5 and medium CVSSv2 of 5.0. Exploit details are n...

CVE-2018-16493

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

PT-2019-9314

Name of the Vulnerable Software and Affected Versions static-resource-server version 1.7.2 simplehttpserver versions prior to 0.2.1 Description A path traversal issue allows unauthorized read access to any file on the server. This is achieved by appending slashes in the URL or using relative path...

CVE-2018-16493: Exposure of Information Through Directory Listing

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to any file on the server by appending slashes in the URL...

Authorization

When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failur...

CVE-2018-15335

When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failur...

CVE-2018-15335

When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failur...

CVE-2018-15335

When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failur...

CVE-2018-15335

The CVE-2018-15335 issue affects BIG-IP APM when deployed as an OAuth Resource Server: in affected 13.0.0–13.1.1 versions, the failure response may omit intended diagnostic content after lost communication with the external OAuth server. F5’s security advisory indicates that for BIG-IP APM, a fix...

PT-2018-12981

Name of the Vulnerable Software and Affected Versions BIG-IP APM versions 13.0.0 through 13.1.x Description The issue occurs when BIG-IP APM is deployed as an OAuth Resource Server and loses communication with an external OAuth authorization server. In such cases, APM may not display the intended...

CVE-2018-15335: Undefined Security Weakness

When APM 13.0.0-13.1.x is deployed as an OAuth Resource Server, APM becomes a client application to an external OAuth authorization server. In certain cases when communication between the BIG-IP APM and the OAuth authorization server is lost, APM may not display the intended message in the failur...

Node.js third-party modules: [static-resource-server] Path Traversal allows to read content of arbitrary file on the server

Module module name: static-resource-server version: 1.7.2 npm page: https://www.npmjs.com/package/static-resource-server Module Description A tiny http server that provides local static resource access Module Stats Replace stats below with numbers from npm’s module page: 0 downloads in the last d...

GHSA-H8W4-QV99-F7VJ Authorization bypass in org.springframework.security.oauth:spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Privilege Escalation in spring-security-oauth2

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval...

Distributed Password Cracking: CrackLord

Over the past several years the world of password cracking has exploded with new tools and techniques. These new techniques have made it easier than ever to reverse captured password hashes. With the addition of powerful techniques, from GPGPU cracking to rainbow tables, it is easier than ever to...