512 matches found
CVE-2024-33898
CVE-2024-33898 concerns Axiros AXESS Auto Configuration Server (ACS) versions 4.x and 5.0.0. The cited vulnerability is an Incorrect Access Control that enables an authorization bypass, allowing unauthenticated remote attackers to achieve remote code execution. The CVE entry indicates a high-seve...
CVE-2023-6717 Keycloak: xss via assertion consumer service url in saml post-binding flow
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...
CVE-2024-22318
IBM i Access Client Solutions ACS 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager NTLM hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try ...
Design/Logic Flaw
IBM i Access Client Solutions ACS 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager NTLM hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try ...
CVE-2024-22318
IBM i Access Client Solutions (ACS) versions 1.1.2–1.1.4 and 1.1.4.3–1.1.9.4 are vulnerable to NTLM hash disclosure. An attacker can modify UNC-capable paths in ACS configuration files to point to a hostile server; if NTLM is enabled on the Windows workstation, the OS will attempt to authenticate...
acs-linksystems.com Cross Site Scripting vulnerability OBB-3838240
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Important: Red Hat Security Advisory: ACS 4.1 enhancement update
Updated images are now available for Red Hat Advanced Cluster Security. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
GO-2023-2114 Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml
The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP context durin...
Cross-site Scripting via missing Binding syntax validation
Impact The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting XSS in the IdP contex...
CVE-2023-45683
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
CVE-2023-45683
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
UBUNTU-CVE-2023-45683
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
CVE-2023-45683 Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
CVE-2023-45683
Removed by vendor...
CVE-2023-45683 Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
CVE-2023-45683 Cross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml
github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...
acs-japan.jp Cross Site Scripting vulnerability OBB-3616452
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Moderate: Red Hat Security Advisory: ACS 4.1 enhancement and security update
Updated images are now available for Red Hat Advanced Cluster Security RHACS. The updated image includes new features and bug fixes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detaile...
acs-e.com Cross Site Scripting vulnerability OBB-3352302
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Moderate: Red Hat Security Advisory: RHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update
An updated version of Red Hat Update Infrastructure RHUI is now available. RHUI 4.4 fixes several security and operational bugs, and introduces multiple new features. Red Hat Update Infrastructure RHUI offers a highly scalable, highly redundant framework that enables you to manage repositories an...