GHSA-XHQQ-X44F-9FGG Authentication Bypass in github.com/russellhaering/gosaml2

Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...

GHSA-CH68-7CF4-35VR Limited ability to spoof SAML authentication with missing audience verification in Fleet

Impact This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reuse the SAML response to log into Fleet as a user -- only if the user has an account with the same email in Fleet, and the user signs into the malicious SP via SAML SSO...

Authentication flaw

fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reu...

CVE-2022-23600 Limited ability to spoof SAML authentication with missing audience verification

fleet is an open source device management, built on osquery. Versions prior to 4.9.1 expose a limited ability to spoof SAML authentication with missing audience verification. This impacts deployments using SAML SSO in two specific cases: 1. A malicious or compromised Service Provider SP could reu...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

Server side request forgery (ssrf)

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

CVE-2022-24129

The vulnerability CVE-2022-24129 affects the Shibboleth Identity Provider OIDC OP plugin before version 3.0.4. Root cause: insufficient restriction of the request_uri parameter enables server-side request forgery (SSRF), allowing interaction with arbitrary third-party HTTP services. Impact is SSR...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

Shibboleth 代码问题漏洞

Shibboleth is an open source SAML-based Web single sign-on system for Windows platforms from Shibboleth, UK. A security vulnerability exists in the Shibboleth Identity Provider, which stems from an under-restricted requesturi parameter, in the OIDC OP plugin for the Shibboleth Identity Provider...

Information Disclosure

is vulnerable to information disclosure. The vulnerability exists because response received from a identity provider is not properly validated which allows an attacker to gain access to the identity of another user...

CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

Code injection

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

UBUNTU-CVE-2021-43999

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user...

CVE-2021-43999

CVE-2021-43999 affects Apache Guacamole 1.2.0 and 1.3.0 when SAML authentication is enabled. The issue arises from improper validation of responses from the SAML identity provider, which could allow a malicious user to impersonate another Guacamole user. Multiple connected sources (NVD, OSV, CNVD...

Apache Guacamole 授权问题漏洞

Apache Guacamole is a clientless remote desktop gateway from the Apache Foundation in the United States. The product supports protocols such as VNC, RDP, and SSH. A security vulnerability exists in Apache Guacamole 1.2.0 and 1.3.0, which stems from the failure of Apache Guacamole 1.2.0 and 1.3.0 ...

PT-2022-11969 · Apache +1 · Apache Guacamole +1

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 1.2.0 through 1.3.0 Description: The issue concerns the improper validation of responses from a SAML identity provider. If SAML support is enabled, a malicious user may assume the identity of another Guacamole user...

CVE-2021-44937

creationtimestamp| type| source ---|---|--- 2021-12-14 16:13:02+00:00| seen| https://t.me/cibsecurity/33926...