Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
passport vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2022-39299
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP ...
Passport-saml Project Passport-saml 4.0.0
Passport-saml Project Passport-saml
1 Github repository
4.3
CVSSv2
CVE-2016-7191
The Microsoft Azure Active Directory Passport (aka Passport-Azure-AD) library 1.x prior to 1.4.6 and 2.x prior to 2.0.1 for Node.js does not recognize the validateIssuer setting, which allows remote malicious users to bypass authentication via a crafted token.
Microsoft Azure Active Directory Passport 2.0.0
Microsoft Azure Active Directory Passport 1.3.2
Microsoft Azure Active Directory Passport 1.4.1
Microsoft Azure Active Directory Passport 1.4.4
Microsoft Azure Active Directory Passport 1.3.6
Microsoft Azure Active Directory Passport 1.3.5
Microsoft Azure Active Directory Passport 1.3.1
Microsoft Azure Active Directory Passport 1.4.0
Microsoft Azure Active Directory Passport 1.1.1
Microsoft Azure Active Directory Passport 1.2.0
Microsoft Azure Active Directory Passport 1.0.0
Microsoft Azure Active Directory Passport 1.3.0
Microsoft Azure Active Directory Passport 1.4.3
Microsoft Azure Active Directory Passport 1.1.0
Microsoft Azure Active Directory Passport 1.3.4
Microsoft Azure Active Directory Passport 1.3.3
Microsoft Azure Active Directory Passport 1.4.5
Microsoft Azure Active Directory Passport 1.4.2
5.8
CVSSv2
CVE-2022-25896
This affects the package passport prior to 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
Passport Project Passport
5
CVSSv2
CVE-2021-39171
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This...
Passport-saml Project Passport-saml
2.1
CVSSv2
CVE-2018-17499
Envoy Passport for Android and Envoy Passport for iPhone could allow a local malicious user to obtain sensitive information, caused by the storing of unencrypted data in logs. An attacker could exploit this vulnerability to obtain two API keys, a token and other sensitive informa...
Envoy Passport 2.4.0
Envoy Passport 2.2.5
2.1
CVSSv2
CVE-2018-17500
Envoy Passport for Android and Envoy Passport for iPhone could allow a local malicious user to obtain sensitive information, caused by the storing of hardcoded OAuth Creds in plaintext. An attacker could exploit this vulnerability to obtain sensitive information.
Envoy Passport 2.4.0
Envoy Passport 2.2.5
NA
CVE-2023-29019
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to ...
Fastify Passport
NA
CVE-2023-29020
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network an...
Fastify Passport
5
CVSSv2
CVE-2022-26952
Digi Passport Firmware up to and including 1.5.1,1 is affected by a buffer overflow in the function for building the Location header string when an unauthenticated user is redirected to the authentication page.
Digi Passport Firmware
5
CVSSv2
CVE-2021-41580
The passport-oauth2 package prior to 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an appl...
Passportjs Passport-oauth2
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
logic flaw
CVE-2024-23692
CVE-2024-26229
CVE-2024-35255
CVE-2024-5835
CVE-2024-5837
XML external entity
dos
CVE-2024-5813
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
NEXT »