3 results (0.004 seconds)

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2016-2049

https://notcve.org/view.php?id=CVE-2016-2049

01 Feb 2016 — examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header. examples/consumer/common.php en la librería JanRain PHP OpenID (también conocida como php-openid) verifica incorrectamente el parámetro openid.realm contra el elemento SERVER_NAME en el array s... • http://www.openwall.com/lists/oss-security/2016/01/24/2 • CWE-284: Improper Access Control •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2013-4701

https://notcve.org/view.php?id=CVE-2013-4701

21 Aug 2013 — Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Auth/Yadis/XML.php en PHP OpenID Library v2.2.2 y anteriores permite a atacantes remotos leer archivos arbitrarios, enviar peticiones HTTP a los servidores de int... • http://jvn.jp/en/jp/JVN24713981/index.html •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1

CVE-2011-3707

https://notcve.org/view.php?id=CVE-2011-3707

23 Sep 2011 — JanRain PHP OpenID library (aka php-openid) 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files. JanRain PHP OpenID (también conocido como php-openid) v2.2.2 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró... • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •