PT-2020-18458

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 74.14.0 Description A CSRF issue exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers. Recommendations For versions prior t...

CVE-2020-5402: Cross-Site Request Forgery (CSRF)

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

CVE-2020-5402

In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers...

Open Redirection

hellojs is vulnerable to open redirection. Lack of validation of the pageuri field of the state parameter allows a remote attacker to perform phishing attacks on users by redirecting a user to a malicious web page that looks exactly like the original site, enticing users to log-in to the fake...

CVE-2019-15150

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...

CVE-2019-15150

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...

CVE-2019-15150: Cross-Site Request Forgery (CSRF)

In the OAuth2 Client extension before 0.4 for MediaWiki, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function...

CVE-2018-12300

Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...

PT-2019-8887

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1 Description The issue allows attackers to disclose information in the Referer header via the 'state' URL parameter in echo-server.html. This is due to an arbitrary redirect in the affected software...

CVE-2018-12300: URL Redirection to Untrusted Site

Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL parameter...

CVE-2019-10315

Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF...

CVE-2019-10315: Cross-Site Request Forgery (CSRF)

Jenkins GitHub Authentication Plugin 0.31 and earlier did not use the state parameter of OAuth to prevent CSRF...

CSRF vulnerability in OAuth callback in github-oauth

github-oauth did not manage the state parameter of OAuth to prevent CSRF. This allowed an attacker to catch the redirect URL provided during the authentication process using OAuth and send it to the victim. If the victim was already connected to Jenkins, their Jenkins account would be attached to...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

Sql injection

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

PT-2019-18277

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the admin.php?mod=order API endpoint, specifically through the state parameter. Recommendations For PHPSHE version 1.7, consider restricting access to the...

CVE-2019-6708: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful...

hsweb cross-site request forgery vulnerability

hsweb is a set of projects for rapid construction of enterprise website backend management system, which integrates online code generation, rights management, single sign-on and dynamic multi-data source distributed transaction processing and other functions. hsweb 3.0.4 version of the...