Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: auth0 Component: Lock Clear all filters
TI-2022-11716 CVE-2022-29172 · GHSA-7ww6-75fj-jcj7

HTML injection with additional signup fields

Priority LOW 28

Auth0 is an authentication broker that supports both social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00622 Published 2022-05-05 Fixed in 11.33.0 CWE-79
TI-2021-12309 CVE-2021-32641 · GHSA-jr3j-whm4-9wwm

Reflected XSS when using flashMessages

Priority LOW 38

auth0-lock is Auth0's signin solution.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01539 Published 2021-06-04 Fixed in 11.30.1 CWE-79
TI-2020-11893 CVE-2020-15119 · GHSA-6gg3-pmm7-97xc

DOM-based XSS in auth0-lock

Priority LOW 29

In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM.

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00546 Published 2020-08-19 Fixed in 11.26.3 CWE-79