Bypassing Authentication And Spoofing Arbitrary OpenID Identities

zendframework/zendopenid and magento/zendframework1 are vulnerable to bypassing authentication and spoofing arbitrary OpenID identities. The application fails to validate that openidopendpoint value identifies the same Identity Provider as the provider used in the association handle. This allows ...

Authentication flaw

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

F5 Networks BIG-IP : TMM SSO plugin vulnerability (K95444512)

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

Uninett mod_auth_mellon module authentication bypass vulnerability

modauthmellon is an authentication module for Apache from Uniett. It authenticates users against the SAML 2.0 IdP and grants access to directories based on attributes received from the IdP. An unspecified authentication bypass vulnerability exists in the Uninett modauthmellon module. An attacker...

How to Deploy and Troubleshoot ADC as a SAML IdP or SP

SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...

How to Configure SAML- Introduction?

SAML is an XML-based open standard which enables authentication of users across products or organizations. SAML is used by identity providers such as Google and by identity and authentication products such as Microsoft AD FS, Ping Identity, CA SiteMinder and more. Citrix customers wish to use...

[SECURITY] Fedora 24 Update: ipsilon-2.0.2-2.fc24

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 25 Update: ipsilon-2.0.2-2.fc25

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

New Relic: SSO Authentication Bypass

Hi, As I reported to [email protected], here's the authentication bypass vulnerability report. I've left some details out in this report but you're welcome to reach out to me with any questions. Here's a more detailed overview: SSO Authentication Bypass Summary It is possible to POST a custom...

Shibboleth Identity Provider Installed

Binary data shibbolethidpinstalled.nbin...

Shibboleth Identity Provider Installed (Linux)

Binary data shibbolethidpinstallednix.nbin...

Ipsilon IdP Server Denial of Service Vulnerability

Ipsilon is a server and toolkit for configuring Apache-based service providers. In Ipsilon versions 0.1.0-1.0.2, 1.1.x-1.1.1, the IdP server's providers/saml2/admin.py fails to properly check permissions, which can be exploited by a remote attacker to cause a denial of service by removing the SAM...

CVE-2015-5301

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider SP...

Code injection

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider SP owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name...

PYSEC-2015-42

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider SP...

Code injection

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider SP...

PYSEC-2015-41

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider SP owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name...

CVE-2015-5217

providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider SP owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name...