Oracle Linux 7 : mod_auth_mellon (ELSA-2019-0766)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-0766 advisory. - Resolves: rhbz1697488 - CVE-2019-3877 modauthmellon: open redirect in logout url when using URLs with backslashes - Resolves: rhbz1697488 -...

PT-2019-7880

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 1.12.4 saml2-js versions prior to 2.0.2 Description The issue arises from the incorrect utilization of XML DOM traversal and canonicalization APIs, allowing an attacker to manipulate SAML data without invalidating it...

PT-2019-11094

Name of the Vulnerable Software and Affected Versions: Duo Network Gateway versions 1.2.9 and earlier Description: The issue may allow an attacker to manipulate SAML data without invalidating its cryptographic signature, potentially bypassing authentication to SAML service providers. This is due ...

CVE-2018-7340: Improper Authentication

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

CVE-2017-11430: Improper Authentication

OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

CVE-2017-11429: Improper Authentication

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11427: Improper Authentication

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

PT-2019-7879 · Onelogin +2 · Onelogin Ruby-Saml +2

Name of the Vulnerable Software and Affected Versions: OneLogin Ruby-SAML versions 1.6.0 and earlier Description: The issue may allow an attacker to manipulate SAML data without invalidating its cryptographic signature, potentially bypassing authentication to SAML service providers. This is due t...

CentOS 7 : mod_auth_mellon (CESA-2019:0766)

An update for modauthmellon is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2017-11428: Improper Authentication

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

mod_auth_mellon security update

CentOS Errata and Security Advisory CESA-2019:0766 An update for modauthmellon is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: mod_auth_mellon security and bug fix update

An update for modauthmellon is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

[SECURITY] Fedora 30 Update: mod_auth_mellon-0.14.2-1.fc30

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

[SECURITY] Fedora 29 Update: mod_auth_mellon-0.14.0-5.fc29

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

USN-3924-1: mod_auth_mellon vulnerabilities

It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. CVE-2019-3877 It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to access...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1793)

Summary There is a potential cross-site scripting vulnerability in SAML ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2018-1793)

Summary There is a potential Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Tivoli Integrated Portal Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This...

Authentication flaw

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

DEBIAN-CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...