PT-2020-18078

Name of the Vulnerable Software and Affected Versions IBM Sterling External Authentication Server versions 2.4.2 through 6.0.1 IBM Sterling Secure Proxy versions 3.4.2 through 6.0.1 Description The issue allows for an XML External Entity Injection XXE attack when processing XML data. A remote...

CVE-2020-4462: Improper Restriction of XML External Entity Reference

IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive...

Security Bulletin: XML External Entity Injection (XXE) Vulnerability Affects IBM Secure External Authentication Server (CVE-2020-4462)

Summary An XXE vulnerability was addressed by IBM Secure External Authentication Server. Vulnerability Details CVEID: CVE-2020-4462 DESCRIPTION: IBM Sterling External Authentication Server and IBM Sterling Secure Proxy is vulnerable to an XML External Entity Injection XXE attack when processing X...

UBUNTU-CVE-2019-12428

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...

Authorization

An issue was discovered in GitLab Community and Enterprise Edition 6.8 through 11.11. Users could bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. It has Improper Authorization...

CVE-2019-12428

Removed by vendor...

PT-2020-9314

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 6.8 through 11.11 Description: An issue allows users to bypass the mandatory external authentication provider sign-in restrictions by sending a specially crafted request. This issue is related ...

CVE-2013-0517

A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code...

CVE-2013-0517

IBM Sterling External Authentication Server (SEAS) is affected by CVE-2013-0517: an OS command can be executed via the Command Line Adapter when an administrator configures a system command. Impact: local attacker with admin privileges could run arbitrary OS commands, compromising confidentiality...

PT-2020-7332

Name of the Vulnerable Software and Affected Versions: IBM Sterling External Authentication Server versions 2.2.0 through 2.4.1 Description: A Command Execution issue exists via an unspecified OS command, which could let a local malicious user execute arbitrary code. Recommendations: For versions...

CVE-2013-0517: Improper Neutralization of Special Elements used in an OS Command

A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code...

DEBIAN-CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

Authentication flaw

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

UBUNTU-CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, 1 which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, 2 when an authentication plugin returns a false in the strict function, could allow remo...

Security Bulletin: Multiple Vulnerabilities in IBM java Runtime Affect IBM Sterling External Authentication Server

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 1.8 used by IBM Sterling External Authentication Server. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID: CVE-2018-12547 DESCRIPTION: Eclipse OpenJ9 is...

PT-2020-1393 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC could allow an unauthenticated, remote attacker to bypass...

CVE-2019-6700

An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code...

Information disclosure

An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code...

CVE-2019-6700

An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may allow an authenticated attacker to retrieve the external authentication password via the HTML source code...