CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/04/2020 |
| CVE-2020-7948 | 높음8.8 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference. | 01/04/2020 |
| CVE-2020-7947 | 심각9.8 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from different sources. One issue with this is that the data isn't sanitized, and no input validation is performed, before the exporting of the user data. This can lead to (at lea | 01/04/2020 |
| CVE-2020-6753 | 보통6.1 | The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages, a different issue than CVE-2020-5392. | 01/04/2020 |
| CVE-2020-5392 | 보통6.1 | A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. | 01/04/2020 |
| CVE-2020-5391 | 높음8.8 | Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. | 01/04/2020 |
| CVE-2019-20173 | 보통6.1 | The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php. | 05/02/2020 |
| CVE-2019-20174 | 보통6.1 | Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder. | 03/02/2020 |
| CVE-2019-16929 | 높음7.5 | Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens. | 08/10/2019 |
| CVE-2019-13483 | 높음7.3 | Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms. | 25/07/2019 |
| CVE-2019-7644 | 심각9.8 | Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is presented to an attacker, they can forge an arbitrary JWT token that will be accepted by the vulnerable application. | 11/04/2019 |
| CVE-2018-11537 | 보통6.5 | Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain. | 19/06/2018 |
| CVE-2015-9235 | 심각9.8 | In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family). | 29/05/2018 |
| CVE-2018-6874 | 높음8.8 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. | 04/04/2018 |
| CVE-2018-6873 | 심각9.8 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. | 04/04/2018 |
| CVE-2018-7307 | 높음8.8 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. | 06/03/2018 |
| CVE-2017-16897 | 높음8.1 | A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within t | 27/12/2017 |
| CVE-2017-17068 | 높음7.5 | A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback(). | 06/12/2017 |