Description
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2014-6545 Vulnerability (CVE-2014-6545)
WordPress Improper Input Validation Vulnerability (CVE-2017-9065)
WordPress Plugin Email Subscriber Cross-Site Scripting (1.1)
WordPress Plugin WP Frontend Profile Security Bypass (1.2.1)
WordPress Plugin Product Addons & Fields for WooCommerce Arbitrary File Upload (1.1)