CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

Authentication flaw

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

Dex Idp Dex Security Breach

Dex Idp Dex is a Go-based language from the Dex Idp team that provides for plug-and-play OpenId authentication and Oauth authentication. A vulnerability exists in the SAML connector in Dex Idp Dex. The vulnerability stems from an error in SAML validation that allows an attacker to bypass SAML...

CVE-2020-14302

A flaw was found in Keycloak, where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks...

Red Hat Keycloak Security Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Keycloak that originates when, after successful authentication, an external identity provider redirects to a...

DRUPAL-CONTRIB-2020-038

This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website. The module has two Authentication Bypass vulnerabilities...

SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-038

This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website. The module has two Authentication Bypass vulnerabilities...

CVE-2020-5425

Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...

Authentication flaw

Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...

CVE-2020-5425

CVE-2020-5425 affects VMware Tanzu SSO: all versions prior to 1.11.3, 1.12.x prior to 1.12.4, and 1.13.x prior to 1.13.1 are vulnerable to a user-impersonation attack. If two users are logged into the SSO operator dashboard concurrently with the same username from different identity providers, on...

CVE-2020-5425 User Impersonation possible in Tanzu SSO

Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...

Gradle Enterprise Code Issue Vulnerability

Gradle is a set of JVM-based project build tools , it supports maven, Ivy repository and so on. A security vulnerability exists in Gradle Enterprise versions 2018.5 through 2020.2.4. The vulnerability stems from a SAML IDP configuration via upload that has XXE with a generated SSRF.No detailed...

Azure VMware Solution Support — Considerations and Limitations

Challenge Azure VMware Solution AVS is a VMware Cloud Verified offering that requires specific considerations to work with Veeam Backup & Replication. Aside from the listed instructions and limitations below, you can use AVS with Veeam Backup & Replication like you would any other VMware vSphere...

IBM WebSphere Application Server 8.0.0.x <= 8.0.0.15 / 8.5.x <= 8.5.5.13 / 9.0.x <= 9.0.0.8 Information Disclosure (711983)

The IBM WebSphere Application Server running on the remote host is version 8.0.0.0 through 8.0.0.15, 8.5.0.0 through to 8.5.5.13, or 9.0.0.0 through 9.0.0.8. It is, therefore, affected by an information disclosure vulnerability due to malformed SAML responses from the SAML identity provider. C...

The vulnerability of the Security Assertion Markup Language (SAML) implementation in the PAN-OS operating system allows a perpetrator to increase their privileges.

The vulnerability of the Security Assertion Markup Language SAML implementation in the PAN-OS operating system is related to incorrect verification of the cryptographic signature. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely, provided that the SAM...

keycloak: missing input validation in IDP authorization URLs

A flaw was found in Keycloak, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients...

CVE-2020-2021

When Security Assertion Markup Language SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled unchecked, improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources...

CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication

When Security Assertion Markup Language SAML authentication is enabled and the ‘Validate Identity Provider Certificate’ option is disabled unchecked, improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources...