Read the docs

Scratchoauth2 Project

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Scratchoauth2 Project records in CISA KEV

No Scratchoauth2 Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Scratchoauth2 4 records MEDIUM

Records

4 records

TI-2021-21133 CVE-2021-46250 · GHSA-jqrv-fv72-xjh3

An issue in SOA2Login::commented of ScratchOAuth2 before commit…

Priority MEDIUM 45

An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01052 Published 2022-02-15 No fix listed
TI-2021-21132 CVE-2021-46249 · GHSA-v85q-g5fq-684c

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in…

Priority LOW 30

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is v…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00643 Published 2022-02-15 No fix listed CWE-639
TI-2021-21134 CVE-2021-46251 · GHSA-qm66-q3cq-c2q3

A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit…

Priority LOW 28

A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00562 Published 2022-02-15 No fix listed CWE-79
Open these records in search →