4092 matches found
CVE-2022-0903
CVE-2022-0903 describes a call stack overflow bug in Mattermost Server’s SAML login feature. In versions up to and including 6.3.2, a maliciously crafted POST body can trigger a stack overflow, causing the server to crash (Denial of Service). Affected: Mattermost Server, SAML login handler; Impac...
CVE-2022-0903 Stack overflow in SAML login in Mattermost
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body...
Casdoor SQL Injection (CVE-2022-24124)
On Jan 22, 2022, a high severity SQL Injection vulnerability was reported in Casdoor which affected versions before 1.13.1 release. The vulnerability is tracked as CVE-2022-24124 with CVSS V3 7.5 score has a publicly available simple proof of concept which makes it easier for skilled attackers to...
JetBrains Hub has an unspecified vulnerability (CNVD-2022-17757)
JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together.A security vulnerability exists in versions prior to JetBrains Hub 2022.1.14434, which stems from allowing SAML requests to take over. No detail...
CVE-2022-26155
An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body...
Exploit for Authentication Bypass by Spoofing in Zabbix
CVE-2022-23131 Zabbix - SAML SSO Authentication Bypass Des...
Cherwell Service Management 跨站脚本漏洞
Cherwell Service Management is a comprehensive service desk solution from Cherwell USA, validated against 11 ITIL® processes. Meet the changing and growing needs of your entire organization with less hassle and lower costs. A cross-site scripting vulnerability exists in Cherwell Service Managemen...
Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities
According to its self-reported version number, the instance of Zabbix running on the remote host is 5.4.x prior to 5.4.9. It is, therefore, affected by multiple vulnerabilities: - In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
Design/Logic Flaw
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
CVE-2022-25262
JetBrains Hub exposes a SAML request takeover vulnerability (CVE-2022-25262) in Hub versions before 2022.1.14434. Root cause: insufficient verification/handling of SAML requests, enabling takeover of SAML responses. Affects Hub’s SAML OAuth2->SAML exchange and may allow an attacker to misuse a...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
PT-2022-3565 · Jetbrains · Jetbrains Hub
Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2022.1.14434 Description: The issue is related to insufficient authentication data verification in JetBrains Hub, allowing a remote attacker to exploit the vulnerability and gain access to confidential data,...
CISA Alerts on Actively Exploited Flaws in Zabbix Network Monitoring Platform
The U.S. Cybersecurity and Infrastructure Security Agency CISA has warned of active exploitation of two security flaws impacting Zabbix open-source enterprise monitoring platform, adding them to its Known Exploited Vulnerabilities Catalog. On top of that, CISA is also recommending that Federal...
Exploit for Authentication Bypass by Spoofing in Zabbix
Zabbix SAML SSO Login Bypass Vulnerability CVE-2022-23131 Env...
Zabbix Frontend Authentication Bypass Vulnerability
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML...
Authentication Bypass
github.com/fleetdm/fleet, is vulnerable to authentication bypass. The vulnerability exists due to stdlib XML parsing in the validate.go file and valid SAML response allowing an attacker to modify the trusted document and cause unauthorized login through SAML IdP...
SAML authentication vulnerability due to stdlib XML parsing
Impact Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. Patches This iss...
GHSA-W3WF-CFX3-6GCX SAML authentication vulnerability due to stdlib XML parsing
Impact Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. Patches This iss...