User may be redirected to On-premises AAA Logout Page after Logging off Citrix Cloud

When you deploy an on-premises Citrix GatewayNetScaler Gateway as the OAuth IDP for Citrix Cloud. User may be redirected toon-premises IDP logout page/vpn/tmlogout.html instead of Citrix Cloud login page after logging out Citrix Cloud. For example, you have the following URLs: Citrix Cloud URL:...

GHSA-9M92-QWPC-QM78 Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections...

Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32993

Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32994

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

Code injection

Jenkins SAML Single Sign OnSSO Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata, which could be abused using a man-in-the-middle attack to intercept these connections...

CVE-2023-32994

Summary of CVE-2023-32994 : The Jenkins SAML Single Sign On (SSO) Plugin (versions ≤ 2.1.0) unconditionally disables SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to fetch SAML metadata. This vulnerability enables potential man-in-the-middle attacks on those m...

Cyolo Product Overview: Secure Remote Access to All Environments

Operational technology OT cybersecurity is a challenging but critical aspect of protecting organizations' essential systems and resources. Cybercriminals no longer break into systems, but instead log in – making access security more complex and also more important to manage and control than ever...

SAML authentication fails with PingFed IdP with error "There was a failure with the mapped account"

Users get the error: "There was a failure with the mapped account" when attempt to login to StoreFront URL after configuring SAML authentication on the StoreFront server with PingFed IdP When checked the Citrix Delivery Services event logs from SF, we see below error: The security token failed...

Intel® Distribution for Python 2018 for Windows* Advisory

Summary: A potential security vulnerability in Intel® Distribution for Python IDP 2018 may allow an unprivileged user to escalate privileges via a local vector. Intel is releasing IDP updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2018-12175 Description: Defau...

OpenSearch has time discrepancy in authentication responses

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider IdP, and not other externally configured IdPs. Patches OpenSearch 1.3.9...

GHSA-C6WG-CM5X-RQVJ OpenSearch has time discrepancy in authentication responses

Impact There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider IdP, and not other externally configured IdPs. Patches OpenSearch 1.3.9...

CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the interna...

OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

The plugin does not have CSRF checks when discarding Identify providers IdP, which could allow attackers to make logged in admins delete all IdP via a CSRF attack Make a logged in admin open: https://example.com/wp-admin/admin.php?page=mooauthsettings&tab=config&action=discard...

OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

The plugin does not have CSRF checks when discarding Identify providers IdP, which could allow attackers to make logged in admins delete all IdP via a CSRF attack PoC Make a logged in admin open: https://example.com/wp-admin/admin.php?page=mooauthsettings=config=discard...

OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSRF

The plugin does not have CSRF checks when deleting Identity Providers IdP, which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack https://example.com/wp-admin/admin.php?page=mooauthsettings&tab=config&action=delete&app=wordpress...

OAuth Single Sign On - SSO (OAuth Client) Standard < 28.4.9 - IdP Deletion via CSRF

The plugin does not have CSRF checks when deleting Identity Providers IdP, which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack https://example.com/wp-admin/admin.php?page=mooauthsettings&tab=config&action=delete&app=wordpress...

OAuth Single Sign On - SSO (OAuth Client) Enterprise < 48.4.9 - IdP Deletion via CSRF

The plugin does not have CSRF checks when deleting Identity Providers IdP, which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack https://example.com/wp-admin/admin.php?page=mooauthsettings&tab=config&action=delete&app=wordpress...

K05018525: BIG-IP APM SAML IdP vulnerability CVE-2018-5549

Security Advisory Description APMD may core when processing SAML Assertion or response containing certain elements. CVE-2018-5549 Impact This vulnerability allows a disruption of service. Security Advisory Status F5 Product Development has assigned ID 704580 BIG-IP to this vulnerability. To...

SUSE CVE-2014-3603

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...