CVE-2018-0018 SRX Series: A crafted packet may lead to information disclosure and firewall rule bypass during compilation of IDP policies.

On SRX Series devices during compilation of IDP policies, an attacker sending specially crafted packets may be able to bypass firewall rules, leading to information disclosure which an attacker may use to gain control of the target device or other internal devices, systems or services protected b...

beanstalk-dispatch (>=0.0.3 <=0.0.5), cklauth (>=0.1.0 <=0.3.0) +120 more potentially affected by CVE-2018-7537 via django (>=2.0.0 <=2.0.2)

django PYPI version =2.0.0, =0.0.3, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =1.1.0, =0.0.7, =0.1.0, =0.0.2, =1.3.0, =2.0.0, =2.0.2 - django-cas-server =1.0.0 and more Source cves: CVE-2018-7537 Source advisory: SNYK:PYTHON-DJANGO-40779...

CVE-2017-14802

Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third party sites...

CVE-2017-14802

CVE-2017-14802 affects Micro Focus Novell Access Manager Admin Console and IDP servers prior to version 4.3.3, which expose an unvalidated redirect vulnerability that could be exploited by remote attackers to redirect users to third‑party sites. The public records indicate impacted products are N...

Input validation

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

UBUNTU-CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

Design/Logic Flaw

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

PYSEC-2017-26

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

CVE-2017-1000246

Python package pysaml2 version 4.4.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

JVN#79546124: OpenAM (Open Source Edition) vulnerable to authentication bypass

OpenAM Open Source Edition contains an authentication bypass vulnerability. Impact A user may bypass login authentication and access contents for which permissions are not granted. Solution Apply the Patch Patch for this vulnerabiity has been released by Open Source Solution Technology Corporatio...

CVE-2017-12873

SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...

Authentication Bypass

simplesamlphp is vulnerable to authentication bypass. When the IdP is incorrectly configured it is possible for multiple users to be assigned a null value as a NameID, allowing a malicious user to authenticate themselves to another user's account...

Juniper Junos SRX IDP Remote Command Injection (JSA10801)

According to its self-reported version and model number, the remote Juniper Junos device is affected by a remote command injection vulnerability in the IDP feature due to improper validation of user-supplied input. An authenticated, remote attacker can exploit this to execute arbitrary shell...

CVE-2017-2349

A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell commands and elevate privileges. Affected releases are Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D60; 12.1X46...

CVE-2017-2349 SRX Series: Command injection vulnerability in SRX IDP feature.

A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell commands and elevate privileges. Affected releases are Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D60; 12.1X46...