Fedora Update for php-onelogin-php-saml FEDORA-2017-68cdc567e9

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-onelogin-php-saml FEDORA-2017-06f4b88ceb

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 25 : php-onelogin-php-saml (2017-06f4b88ceb)

Update to 2.10.5 ---- Update to 2.10.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEV...

[SECURITY] Fedora 25 Update: php-onelogin-php-saml-2.10.5-1.fc25

OneLogin's SAML PHP toolkit let you build a SP Service Provider over your PHP application and connect it to any IdP Identity Provider. Autoloader: /usr/share/php/OneLogin/Saml2/autoload.php...

[SECURITY] Fedora 24 Update: php-onelogin-php-saml-2.10.5-1.fc24

OneLogin's SAML PHP toolkit let you build a SP Service Provider over your PHP application and connect it to any IdP Identity Provider. Autoloader: /usr/share/php/OneLogin/Saml2/autoload.php...

[SECURITY] Fedora 26 Update: php-onelogin-php-saml-2.10.5-1.fc26

OneLogin's SAML PHP toolkit let you build a SP Service Provider over your PHP application and connect it to any IdP Identity Provider. Autoloader: /usr/share/php/OneLogin/Saml2/autoload.php...

onelogin.com XSS vulnerability

Vulnerable URL: https://www.onelogin.com/jp/signup?plan=lol" Details: Description| Value ---|--- Patched:| Yes, at 05.02.2017 Latest check for patch:| 05.02.2017 12:52 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 3617 VIP website status:| Yes Coordinated...

Yelp: Content spoofing on yelp.onelogin

Hi Yelp Team, I'm not sure if this one is out of scope but i want you guys to be aware of it, I have found that content spoofing is possible on yelp onelogin. Reference: https://www.owasp.org/index.php/ContentSpoofing PoC URL:...

WordPress OneLogin SAML SSO Plugin <= 2.4.2 - Signature Wrapping

This plugin is prone to a signature wrapping vulnerability. Solution Update the plugin...

OneLogin SAML SSO <= 2.4.2 - Signature Wrapping

OneLogin SAML SSO updates php-saml library to 2.10.0 it includes SAML Signature Wrapping attack prevention and other security improvements...

OneLogin SecureNotes Breach Exposed Data in Cleartext

Single sign-on company OneLogin began notifying customers this week that an attacker was able to take advantage of a bug in its system and view sensitive notes posted by users, thought to be secure. The company, whose authentication technology secures cloud-based applications, confirmed the...

WordPress OneLogin SAML SSO Plugin Authentication Bypass Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation.OneLogin SAML SSO is one of the plug-ins that allows users to access WordPress sites through SAML single sign-on or authentication with one click. An authentication bypass vulnerability...

Uber paid found the login bypass vulnerability researcher 1 million dollars-vulnerability warning-the black bar safety net

! Car share company Uber recently to repair the company's website, a vulnerability that can allow an attacker without the password can also log some “. uber.com” the website, and further on its internal network attacks. Uber rewards in the last month found that the vulnerability of the Finnish...

Uber Pays Researcher $10K for Login Bypass Exploit

Ridesharing company Uber recently patched a vulnerability in its site that could have allowed an attacker to log into some “.uber.com” sites without a password and further compromise its internal network. Uber awarded Finnish security researcher Jouko Pynnönen $10,000 for discovering the flaw las...

OneLogin SAML SSO <= 2.1.5 - Authentication Bypass

The OneLogin SAML SSO WordPress plugin was affected by an Authentication Bypass security vulnerability...

WordPress OneLogin SAML SSO Plugin <= 2.1.5 - Authentication Bypass

This plugin has a bug which allows anyone to login without a password or other authentication. Solution Update the plugin...

OneLogin SAML SSO <= 2.1.8 - Provisioned User Hardcoded Password

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability...

WordPress OneLogin SAML SSO Plugin <= 2.1.8 - Privilege Escalation

This plugin is prone to a privilege escalation vulnerability. Solution Update the plugin...

Uber: OneLogin authentication bypass on WordPress sites via XMLRPC

When a user logs on one of your WordPress sites via OneLogin, the authentication plugin creates a new entry in the WordPress user database with the default password @@@nopass@@@. This wouldn't be a problem if the plugin disabled all normal WordPress authentication methods, but it doesn't. The...

Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...