KLA10521 Denial of service vulnerability in Shibboleth SP

An unspecified vulnerability was found in Shibboleth SP. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed SAML message. Original advisories Shibboleth advisory Related products...

Debian Security Advisory DSA 3207-1 (shibboleth-sp2 - security update)

A denial of service vulnerability was found in the Shibboleth an federated identity framework Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash. OpenVAS Vulnerability Test $Id: deb3207.nasl 6609 2017-07-07 12:05:59Z...

DSA-3207-1 shibboleth-sp2 - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Axis2 <= 1.6.2 Multiple Vulnerabilities

Apache Axis2 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:apache:axis2"; if...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update

Red Hat JBoss Fuse and A-MQ 6.1.0 Rollup Patch 2 R2, which includes several bug fixes, enhancements, and resolves two security issues, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Oracle OpenSSO SAML Multiple Vulnerabilities (January 2015 CPU)

The remote Oracle OpenSSO component in the Oracle Fusion Middleware install is missing a vendor-supplied security update. It is, therefore, affected by multiple unspecified vulnerabilities in the SAML subcomponent. Note that these vulnerabilities are unspecified by Oracle but appear to be...

Unspecified Vulnerability in Oracle OpenSSO SAML Subpart (CNVD-2015-00551)

OpenSSO project is an open source implementation of SSO Single Sign-On for Web applications deployed on different Web or different servers to provide centralized authentication capabilities . Oracle OpenSSO SAML subcomponent has a security vulnerability that allows remote attackers to exploit the...

Buffer overflow

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592...

CVE-2015-0389

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592...

CVE-2015-0389

CVE-2015-0389 affects the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5. The connected sources describe multiple unspecified vulnerabilities in the SAML subcomponent that could allow remote authenticated users to affect integrity. The reports consistently refer to Open...

Buffer overflow

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2015-0389...

CVE-2014-6592

Technical details for CVE-2014-6592 are not provided in the supplied connected documents; no affected products, root cause, or remediation are specified here. Monitor for updates from official sources to obtain concrete information.

Updated cxf packages fix security vulnerabilities

Updated cxf packages fix security vulnerabilities: An Apache CXF JAX-RS service can process SAML tokens received in the authorization header of a request via the SamlHeaderInHandler. However it is possible to cause an infinite loop in the parsing of this header by passing certain bad values for t...

MGASA-2014-0557 Updated cxf packages fix security vulnerabilities

Updated cxf packages fix security vulnerabilities: An Apache CXF JAX-RS service can process SAML tokens received in the authorization header of a request via the SamlHeaderInHandler. However it is possible to cause an infinite loop in the parsing of this header by passing certain bad values for t...

Updated wss4j packages fix CVE-2014-3623

Updated wss4j packages fixes security vulnerability: Apache WSS4J before 1.6.17, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors CVE-2014-3623...

RHEL 5 / 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.3.2 (RHSA-2014:2019)

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:2019 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 security update

Updated Red Hat JBoss Enterprise Application Platform 6.3.2 packages that fix three security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods

It was found that Apache WSS4J Web Services Security for Java, as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of...