CVE-2020-36599

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-36609.8Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-366007.5Out-of-bounds write vulnerability in the power consumption module. Successful exploitation of this vulnerability may cause the system to resCVE-2020-366017.5Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot.CVE-2020-366026.1There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and CVE-2020-366036.5The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function calCVE-2020-366048.1hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.CVE-2020-366054.4Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops CeCVE-2020-366076.1Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tCVE-2020-366086.1A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS. Affected by this issue is some unknown fCVE-2020-366095.4A vulnerability was found in annyshow DuxCMS 2.1. It has been classified as problematic. This affects an unknown part of the file admin.php&CVE-2020-36619.8Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack of validatiCVE-2020-366108.0A vulnerability was found in annyshow DuxCMS 2.1. It has been declared as problematic. This vulnerability affects unknown code. The manipula
CVE-2020-36599: Critical severity, CVSS 9.8 | Vulnix