Juniper Networks IDP Appliance Configuration Manager Cross-Site Scripting Vulnerability

Juniper Networks IDP is a suite of intrusion detection defense solutions. A cross-site scripting vulnerability exists in Juniper Networks IDP Appliance Configuration Manager due to a failure to adequately validate user input. An attacker could exploit this vulnerability to execute arbitrary scrip...

How to Deploy and Troubleshoot ADC as a SAML IdP or SP

SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...

[SECURITY] Fedora 23 Update: mod_auth_mellon-0.11.1-1.fc23

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

CVE-2015-5301

CVE-2015-5301 affects Ipsilon IdP (providers/saml2/admin.py). In Ipsilon 0.1.0–1.0.2 and 1.1.x–1.1.1, incorrect permission checks allow remote authenticated users to delete a SAML2 Service Provider (SP) and cause a denial of service. Affected versions are 0.1.0 before 1.0.2 and 1.1.x before 1.1.1...

CVE-2015-5301

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider SP...

Red Hat PicketLink IDP ignores role based authorization

No description provided by source...

Red Hat PicketLink Privilege Bypass Vulnerability

Red Hat PicketLink is a unified identity management framework for Java applications. The 'invokeNextValve' function in the identity/federation/bindings/tomcat/idp/AbstractIDPValve.java file of Red Hat PicketLink failed to correctly Checking role-based authorization allows remote attackers to send...

CVE-2015-3158

CVE-2015-3158 affects PicketLink in Red Hat JBoss EAP 6.x where the invokeNextValve in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java fails to enforce role-based authorization. This allows remote authenticated users to access restricted resources via a direct request or an SP-initi...

RHEL 5 : Red Hat JBoss Enterprise Application Platform (RHSA-2015:1669)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1669 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

RHEL 6 : Red Hat JBoss Enterprise Application Platform (RHSA-2015:1670)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1670 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

An updated Red Hat JBoss Enterprise Application Platform 6.4.3 package that fixes a security issue, several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

An updated Red Hat JBoss Enterprise Application Platform 6.4.3 package that fixes a security issue, several bugs and adds various enhancements is now available for Red Hat Enterprise Linux 5. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss...

Moderate: Red Hat Security Advisory: jboss-ec2-eap bug fix security update

An updated jboss-ec2-eap package that that fixes a security issue, fixes several bugs and adds various enhancements is now available for Red Hat JBoss Enterprise Application Platform 6.4.3 on Red Hat Enterprise Linux 6. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java EE...

IPsec Tools denial of service 0day vulnerabilities detail report-vulnerability warning-the black bar safety net

IPsec-tools recently exposed a denial of service 0day vulnerabilities, and the Internet has appeared the use of the program. You may be questioning the vulnerability does not even reach a moderate vulnerability rating, but remember that IPsec is critical infrastructure, and this attack requires...

Juniper IDP ACM Web服务器跨站脚本漏洞

CVE ID:CVE-2013-6957 Juniper IDP解决方案是业界领先的解决方案,可帮助管理员检测、控制并报告受到各种间谍软件应用威胁的系统。 Juniper IDP没有正确过滤提交给ACM WEB服务器的输入，允许远程攻击者利用漏洞进行跨站脚本攻击，可构建恶意URI，诱使用户解析，可获取敏感信息或者劫持用户会话。 0 Juniper IDP75 Juniper IDP250 Juniper IDP800 Juniper IDP8200 5.1 厂商补丁： Juniper ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2013-6957

Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...

Cross site scripting

Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...

CVE-2013-6957

Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...

CVE-2013-6957

CVE-2013-6957 is an XSS vulnerability in the Juniper IDP ACM Web Server’s web administration component. The issue allows remote attackers to inject arbitrary script/HTML via unspecified vectors to the ACM web server, potentially exposing sensitive information or enabling user session manipulation...

Barnraiser Prairie Directory Traversal

The OpenID idp software "Barnraiser Prairie" http://www.barnraiser.org/prairie/ is vulnerable to directory traversal attacks: ./getfile.php does not limit the given path and allows directory traversal attacks with full public access to all images on the server. Example exploit:...