Login Request a demo
OM
Product
Omniauth
by Omniauth · last CVE Aug 18, 2022
3
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities3In the news0Timeline
Severity mix
Critical 1High 2Medium 0Low 0
Severity
All severities3Critical1High2Medium0Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Omniauth to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-36599
9.8
1%
Aug 18
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value
Affected: before 1.9.2; 2.0.0
CVE-2015-9284
8.8
2%
Apr 26
The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to…
Affected: before 2.0.0
CVE-2017-18076
7.5
2%
Jan 26
In strategy.rb in OmniAuth before 1.3.2, the authenticity_token value is improperly protected because POST (in addition to GET) parameters are stored in the session and become…
Affected: before 1.3.2
Showing 3