[SECURITY] [DSA 4414-1] libapache2-mod-auth-mellon security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4414-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst March 23, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4414-1] libapache2-mod-auth-mellon security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4414-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst March 23, 2019 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4414-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JFrog Artifactory Pro 6.5.9 Signature Validation

CVE-2018-19971: JFrog Artifactory Pro SAML SSO signature validation error ------------------------------------------------------------------------- Affected products ================= The SAML SSO addon in Artifactory 6.5.9 is vulnerable. The SAML SSO addon in Artifactory 6.5.13 is NOT vulnerable...

SAML vulnerability discovery and exploit-vulnerability warning-the black bar safety net

In a recent Web application testing process, I'm in the application of SAML-Security Assertion Markup Language implementation, found a security vulnerability. The application in achieving its SAML capabilities, using an unsafe practice, plus its own custom authentication mechanism is also present...

SAML Signature Relocation Attack

passport-wsfed-saml2 is vulnerable to SAML signature relocation attacks. The vulnerability exists as the validation function does not ensure that the Signature tag is in the correct location in an Assertion tag, allowing attackers to perform signature relocation attacks...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server (CVE-2018-1793)

Summary There is a potential cross-site scripting vulnerability in SAML ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Cross site scripting

A vulnerability in the Security Assertion Markup Language SAML single sign-on SSO interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability is due to...

CVE-2019-1685

A vulnerability in the Security Assertion Markup Language SAML single sign-on SSO interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability is due to...

CVE-2019-1685

Cisco Unity Connection (version 12.5) exposes a reflected XSS vulnerability in the SAML SSO interface due to insufficient input validation. An unauthenticated remote attacker can lure a user to click a crafted link, potentially executing arbitrary script in the interface context or accessing sens...

CVE-2019-1685 Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability

A vulnerability in the Security Assertion Markup Language SAML single sign-on SSO interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability is due to...

CVE-2019-1685 Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability

A vulnerability in the Security Assertion Markup Language SAML single sign-on SSO interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability is due to...

Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability

A vulnerability in the Security Assertion Markup Language SAML single sign-on SSO interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. The vulnerability is due to...

Security Bulletin: Information disclosure in WebSphere Application Server with SAML (CVE-2018-1614)

Summary There is a potential Information disclosure vulnerability in WebSphere Application Server using SAML. Vulnerability Details CVEID: CVE-2018-1614 DESCRIPTION: IBM WebSphere Application Server using malformed SAML responses from the SAML identity provider could allow a remote attacker to...

Security Bulletin: Information disclosure in WebSphere Application Server Liberty (CVE-2018-1553)

Summary There is an information disclosure in WebSphere Application Server Liberty using the SAML Web SSO feature. Vulnerability Details CVEID: CVE-2018-1553 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by mishandling ...

Security Bulletin: Content Collector for Email is affected by 3RD PARTY Reflected XSS in WebSphereSamISP

Summary Content Collector for Email has addressed the following vulnerability. IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...

FreeBSD : Gitlab -- Multiple vulnerabilities (467b7cbe-257d-11e9-8573-001b217b3468)

Gitlab reports : Remote Command Execution via GitLab Pages Covert Redirect to Steal GitHub/Bitbucket Tokens Remote Mirror Branches Leaked by Git Transfer Refs Denial of Service with Markdown Guests Can View List of Group Merge Requests Guest Can View Merge Request Titles via System Notes Persiste...

XPath Injection

python-saml is vulnerable to xpath injection attacks. The vulnerability exists as DTD on the fromstring method was not disabled by default, allowing xpath injection attacks...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitLab Pages Covert Redirect to Steal GitHub/Bitbucket Tokens Remote Mirror Branches Leaked by Git Transfer Refs Denial of Service with Markdown Guests Can View List of Group Merge Requests Guest Can View Merge Request Titles via System Notes Persisten...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.0 security update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 7.2.0, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scorin...