CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

IBM Tivoli Federated Identity Manager SSO XML Parsing Vulnerability

IBM Tivoli Federated Identity Manager is an access management solution that provides Web and federated SSO to end users across multiple applications. An XML parsing vulnerability exists in the Security Assertion Markup Language SAML-based single sign-on SSO system in IBM Tivoli Federated Identity...

Gemalto SafeNet Authentication Service for AD FS Agent Elevation of Privilege Vulnerability

Gemalto SafeNet Authentication Service for AD FS Agent is a federated authentication service agent from Gemalto USA. A security vulnerability exists in Gemalto SafeNet Authentication Service for AD FS Agent, which stems from the program's use of weak access control lists for installation...

Unspecified Vulnerability in Ipsilon

Ipsilon is a server and toolkit for configuring Apache-based service providers to provide federated authentication SSO to web applications with pluggable standalone modwsgi applications. An unspecified vulnerability exists in versions of Ipsilon prior to 2.1.0. No detailed vulnerability details a...

Low: Red Hat Security Advisory: python-django-horizon security and bug fix update

An update for python-django-horizon is now available for Red Hat OpenStack Platform 9.0 Mitaka. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

openstack-keystone: Incorrect role assignment with federated Keystone

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...

CVE-2017-1319

IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session SSL cookie. IBM X-Force ID: 125731...

Code injection

IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session SSL cookie. IBM X-Force ID: 125731...

CVE-2017-1319

Summary: CVE-2017-1319 affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.x (versions 6.2.0, 6.2.1, 6.2.2). The root cause is a missing secure attribute in the encrypted session (SSL) cookie, exposing potential information disclosure. Impact: information disclosure via cookies. Remediation:...

IBM Tivoli Federated Identity Manager Information Disclosure Vulnerability

IBM Tivoli Federated Identity Manager TFIM is a cross-enterprise federated identity management product from IBM, USA. The product provides Web and federated single sign-on capabilities SSO to users using multiple applications. An information disclosure vulnerability exists in IBM TFIM versions...

IBM Tivoli Federated Identity Manager 6.2.x < 6.2.2 FP17 Multiple Vulnerabilities

The version of IBM Tivoli Federated Identity Manager installed on the remote Windows host is 6.2.x prior to 6.2.2.17. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to a failure to properly use Secure attributes in cookies. An...

IBM Tivoli Federated Identity Manager Cross-Site Scripting Vulnerability (CNVD-2017-09951)

IBM Tivoli Federated Identity Manager is a cross-enterprise federated identity management product from IBM USA. A cross-site scripting vulnerability in IBM Tivoli Federated Identity Manager allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

CVE-2017-1320

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

CVE-2017-1320

IBM Tivoli Federated Identity Manager 6.2.x is affected by CVE-2017-1320 (XSS in Web UI) per IBM/SWG bulletin. Affected versions include 6.2.0, 6.2.1, and 6.2.2.x (up to 6.2.2.17). Remediation is to apply patch 6.2.2-FP0017 or upgrade to 6.2.2.17, per IBM’s remediation table. CVSS v3.0 vector (AV...

CVE-2017-1320

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

Nextcloud: (Authenticated) RCE by bypassing of the .htaccess blacklist

Storage::copyFromStorage doesn't check the content of a folder it copies against the list of blacklisted files. Meaning that if a user has access to an external storage inc. fed. shares that contains a .htaccess file, he can move the .htaccess file to the local data directory. The attack works on...

UBUNTU-CVE-2017-2673

An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service keystone. An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles...

PT-2017-15467 · Openstack +1 · Openstack Identity Service +1

Name of the Vulnerable Software and Affected Versions: OpenStack Identity service keystone affected versions not specified Description: An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service. This issue allows an authenticated federated user to...

StoreFront SAML Troubleshooting Guide

During the installation and configuration of the SAML functionality introduced with StoreFront 3.9, there are various items to be aware of when performing a successful configuration. Although there are other issues you might encounter, this document will try to provide direction to help resolve...

FreeBSD : MySQL -- multiple vulnerabilities (22373c43-d728-11e6-a9a5-b499baebfeaf)

The MySQL project reports : - CVE-2016-3492: Remote security vulnerability in 'Server: Optimizer' sub component. - CVE-2016-5616, CVE-2016-6663: Race condition allows local users with certain permissions to gain privileges by leveraging use of mycopystat by REPAIR TABLE to repair a MyISAM table. ...