CVE-2025-56689: Authentication Bypass by Spoofing

One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password OTP/Multifactor Authentication MFA bypass using response manipulation. An attacker who intercepts or captures a valid OTP response can bypass the OTP verification step by replaying th...

Quest One Identity 安全漏洞

Quest One Identity is a software from Quest, Inc. that has the ability to manage user identities and control access rights. A security vulnerability exists in Quest One Identity version 7.5.1.20903, which originates from an OTP bypass and could allow an attacker to take control of arbitrary...

PT-2025-35801

Name of the Vulnerable Software and Affected Versions: Quest One Identity version 7.5.1.20903 Description: A crafted response manipulation can bypass the One-Time Password OTP on the Multi-Factor Authentication MFA page, leading to unauthorized access to the Privileged Access Management PAM porta...

CVE-2025-52924

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header...

CVE-2025-52924

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header...

CVE-2025-52924

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header...

CVE-2025-52924

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header...

One Identity OneLogin SQL注入漏洞

One Identity OneLogin is an identity and access management software from US-based One Identity. An SQL injection vulnerability exists in One Identity OneLogin versions prior to 2025.2.0, which stems from an improperly set SQL connection application name that could lead to information disclosure...

CVE-2025-52924

CVE-2025-52924 affects One Identity OneLogin before 2025.2.0, where the SQL connection “application name” is derived from an untrusted X-RequestId header. This can lead to information disclosure about the SQL connection name. Affected: OneLogin prior to 2025.2.0. Impact per sources: low confident...

PT-2025-30108 · One Identity · Onelogin

Name of the Vulnerable Software and Affected Versions: One Identity OneLogin versions prior to 2025.2.0 Description: The SQL connection “application name” is set based on the value of an untrusted X-RequestId HTTP request header. Recommendations: Update One Identity OneLogin to version 2025.2.0 o...

CVE-2025-52924: Improper Neutralization of Special Elements used in an SQL Command

In One Identity OneLogin before 2025.2.0, the SQL connection "application name" is set based on the value of an untrusted X-RequestId HTTP request header...

CVE-2025-27582

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts ...

CVE-2025-27582

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts ...

CVE-2025-27582

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts ...

CVE-2025-27582

Vulnerability context: CVE-2025-27582 affects One Identity Password Manager prior to 5.14.4. The Secure Password extension uses a kiosk browser to display Password Self‑Service and blocks privileged actions by overriding window.print(). The flaw allows a local attacker with access to a locked wor...

CVE-2025-27582: Inclusion of Functionality from Untrusted Control Sphere

The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flawed security hardening mechanism within the kiosk browser used to display the Password Self-Service site to end users. Specifically, the application attempts ...

PT-2025-29461 · One Identity · One Identity Password Manager

Name of the Vulnerable Software and Affected Versions: One Identity Password Manager versions prior to 5.14.4 Description: The Secure Password extension in One Identity Password Manager contains a flaw in its security hardening mechanism within the kiosk browser used for the Password Self-Service...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

CVE-2025-52925

In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812...

PT-2025-27583 · One Identity · One Identity Onelogin Active Directory Connector

Name of the Vulnerable Software and Affected Versions: One Identity OneLogin Active Directory Connector versions prior to 6.1.5 Description: The issue concerns the mishandling of DirectoryToken encryption, also known as ST-812. This problem occurred due to an error in the encryption process...