9145 matches found
JSP Tickets, 1.1, SQL Injection
JSP Tickets from Joomla Service Provider, versions 1.1 and previous, SQL Injection Resolution: update to version 1.2.0 Update notice: http://www.joomlaserviceprovider.com/jspblog/jsp-tickets-1-2-security-release.html...
Nextcloud: twofactor_auth bypassable if provider fails to load
Just want to preface this by saying that this is probably not a significant vulnerability, as it requires that the server either have recently been incorrectly upgraded or otherwise misconfigured. However in the administration of my own personal NextCloud instance I have hit this several times...
CVE-2018-2371
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
CVE-2018-2371: Improper Neutralization of Input During Web Page Generation
The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...
February 13, 2018—KB4074596 (OS Build 10240.17770)
None None...
[SECURITY] [DSA 4109-1] ruby-omniauth security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4109-1 [email protected] https://www.debian.org/security/ February 09, 2018 https://www.debian.org/security/faq - -------------------------------------------------------------------------...
SimpleSAML php Signature Validation Bypass Vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider features . A signature verification bypass vulnerability exists in the SimpleSAMLXMLValidator class in SimpleSAMLphp 1.14.16 and earlier versions using SAML 1.1. An attacke...
CVE-2017-18122: Improper Verification of Cryptographic Signature
A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...
Your service provider has implemented backup files protection against deletion by an insider for this cloud repository.
Intended Audience Keep in mind that the structure and message of this article are written assuming the reader is a Veeam Cloud Service Provider. Challenge A tenant's backup copy job with GFS disabled displays the following warning when targeting a Cloud Repository provided by a Veeam Cloud Servic...
Cloud Migration Checklist for Application and Data Security
In the final post of our series on cloud migration, we’ve put together a list of strategic and immediate considerations as you plan to migrate your business to the cloud. From a high-altitude viewpoint, cloud security is based on a model of “shared responsibility” in which the concern for securit...
Remote Code Execution (RCE)
resteasy-yaml-provider is vulnerable to remote code execution RCE attacks. These attacks are possible because of an incomplete fix for CVE-2016-9606 which still uses Yaml.load in the YamlProvider. This issue only affects applications which have the YamlProvider explicitly enabled by adding or...
UBUNTU-CVE-2018-1051
It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load in YamlProvider...
CVE-2017-15718
The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications...
Cross-site Scripting (XSS)
sentry-provider-db is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as HTTP TRACE requests are possible, which can lead to XSS attacks...
Shibboleth for Windows Shibboleth Service Provider Shibboleth XMLTooling-C Information Disclosure Vulnerability
Shibboleth for Windows is an open source SAML based Web Single Sign-On system for Windows from Shibboleth, UK. Shibboleth Service Provider SP is one of the Service Provider components. Shibboleth Service Provider SP is one of the service provider component . Shibboleth XMLTooling-C is one of the...
DEBIAN-CVE-2018-0486
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD...
CVE-2018-0486: Improper Verification of Cryptographic Signature
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD...
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...
GHSA-8JJF-W7J6-323C Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...
“Ready Player One” – Are you Ready to Protect Your Endpoints from the Bad Guys?
At times it can feel like a game as you watch the cyber-breach scorecards. Yahoo 3 billion users, Equifax 143 million consumers, Uber 57 million users, Imgur 1.7 million users are just a sample of the companies that have released new information on large breaches in the last few months...