175926 matches found
CVE-2026-15556 Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...
CVE-2026-15556 Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...
CVE-2026-15556
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...
EUVD-2026-55983
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...
CVE-2026-15554
the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...
CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...
CVE-2026-15554 Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...
CVE-2026-15554
Summary: CVE-2026-15554 affects the Undertow AJP listener, where forged ssl_cert and is_ssl AJP attributes can be accepted without shared-secret authentication. An unauthenticated attacker with direct TCP access to port 8009 can bypass CLIENT-CERT authentication by injecting a forged X.509 certif...
CVE-2026-15556
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...
CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
CVE-2026-10579
CVE-2026-10579 affects PicketLink Federation SAML. The flaw: the unsolcited response handler accepts forged SAML assertions without verification, enabling an unauthenticated attacker to impersonate any principal in any role, with possible information disclosure or access to restricted operations....
CVE-2026-10579 Picketlink-federation: auth bypass in picketlink saml unsolicited-response
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
CVE-2026-15554
the Undertow AJP listener honours forged sslcert and isssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP...
CVE-2026-10579 Picketlink-federation: auth bypass in picketlink saml unsolicited-response
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
CVE-2026-10579
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...
sctp: auth: verify auth requirement when auth_chunk is NULL
...
Security Bulletin: Vulnerability in SSSD affects IBM Netezza Appliance
Summary The SSSD package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-14476 Vulnerability Details CVEID:CVE-2026-14476 DESCRIPTION: A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not...
BASM (Broken Authentication & Session Management) in Bitbucket Data Center
This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 9.4.0, 10.2.0, and 10.4.0 of Bitbucket Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perfo...
