339 matches found
CVE-2020-5402
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402 UAA fails to check the state parameter when authenticating with external IDPs
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402: Cross-Site Request Forgery (CSRF)
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
CVE-2020-5402
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...
Open Redirection
hellojs is vulnerable to open redirection. Lack of validation of the pageuri field of the state parameter allows a remote attacker to perform phishing attacks on users by redirecting a user to a malicious web page that looks exactly like the original site, enticing users to log-in to the fake...
CVE-2019-15150
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
CVE-2019-15150: Cross-Site Request Forgery (CSRF)
In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...
CVE-2018-12300
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...
CVE-2018-12300: URL Redirection to Untrusted Site
Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...
CVE-2019-10315: Cross-Site Request Forgery (CSRF)
Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF...
CVE-2019-6708
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
Sql injection
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
CVE-2019-6708
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
CVE-2019-6708: Improper Neutralization of Special Elements used in an SQL Command
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
hsweb cross-site request forgery vulnerability
hsweb is a set of projects for rapid construction of enterprise website backend management system, which integrates online code generation, rights management, single sign-on and dynamic multi-data source distributed transaction processing and other functions. hsweb 3.0.4 version of the...
CVE-2018-20595
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
Cross site request forgery (csrf)
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...
CVE-2018-20595: Cross-Site Request Forgery (CSRF)
A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...