7442 matches found
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
Blitz Identity Provider (Authentication server)
...
sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass
A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
Important: Red Hat Security Advisory: sssd security update
An update for sssd is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery
The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...
ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...
phpBB < 3.3.17 - Authentication Bypass
phpBB before 3.3.17 contains an authentication bypass vulnerability in the login-link feature. By setting the authprovider query parameter to "apache", an unauthenticated attacker can bypass password verification and log in as any user, including administrators. The Apache auth provider trusts th...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: cluster-api-helm-controller, tetragon, istio, kubernetes-csi-external-attacher, azure-service-operator, cert-manager-istio-csr, crossplane, kubernetes-csi-external-resizer, cluster-api, helm-operator, rancher-webhook, datadog-agent, cluster-api-aws-controller, kuma,...
OESA-2026-3149 sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy...
PT-2026-64407
In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend ePA Aktensystem, Konnektor, IDP, TSS can present a self-signed TLS certificate and intercept the connection. For non-VAU connections Konnektor, IDP, this allows direct read and modification of...
CVE-2026-15614
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
CVE-2026-15611
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...
CVE-2026-15611 Unverified email-based SSO account linking
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...
EUVD-2026-48305
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account...
CVE-2026-15611
CVE-2026-15611 affects Logto Identity Platform. An unverified email-based SSO account linking flaw allows an attacker to register the victim’s email at a permissive upstream IdP and link it to the victim’s local account on first login, enabling unauthorized access. Root cause per sources: Logto d...
EUVD-2026-48303
Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window...
CVE-2026-15614
CVE-2026-15614 affects Logto: IdP-initiated SAML sessions are not handled atomically, as session lookup may complete before deletion. This can allow the same session identifier to pass validation twice, enabling replay/dual sign-ins within the session’s window. The description and connected refer...