Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: ory Component: Fosite Clear all filters
TI-2020-12006 CVE-2020-15234 · GHSA-grfp-q2mm-hfp6

Redirect URL matching ignores character casing

Priority LOW 29

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00841 Published 2020-10-02 Fixed in 0.34.1 CWE-20
TI-2020-11994 CVE-2020-15222 · GHSA-v3q9-2p3m-7g43

Replay of private_key_jwt possible in ORY Fosite

Priority LOW 37

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00867 Published 2020-09-24 Fixed in 0.31.0 CWE-287
TI-2020-11995 CVE-2020-15223 · GHSA-7mqr-2v3q-v2wm

Ignored storage errors on token revokation in ORY Fosite

Priority LOW 38

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.01588 Published 2020-09-24 Fixed in 0.34.0 CWE-755