PT-2015-6839

Name of the Vulnerable Software and Affected Versions Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1 Description The issue is related to improper permission checking in the providers/saml2/admin.py file of the Identity Provider IdP server. This allows remote...

PT-2015-7855

Name of the Vulnerable Software and Affected Versions Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1 Description The issue is related to improper permission checking in the providers/saml2/admin.py file of the Identity Provider IdP server. This allows remote...

PT-2015-7854

Name of the Vulnerable Software and Affected Versions Ipsilon versions 0.1.0 through 1.0.0 Description The issue is related to the providers/saml2/admin.py file in the Identity Provider IdP server, where it does not properly check permissions to update the SAML2 Service Provider SP owner. This...

Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129

Shibboleth authentication module allows users to log in and get permissions based on federated SAML2 authentication. The module didn't filter the text that is displayed as a login link. This vulnerability was mitigated by the fact that an attacker must have a role with the permission Administer...

[SECURITY] Fedora 22 Update: lasso-2.4.1-3.fc22

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

[SECURITY] Fedora 20 Update: lasso-2.4.1-1.fc20

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.3.3 update (Moderate) (RHSA-2015:0216)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:0216 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was found that t...

SA-CONTRIB-2015-028 - Shibboleth Authentication - Cross Site Request Forgery (CSRF)

Shibboleth Authentication module allows users to log in and get permissions based on federated SAML2 authentication. The roles that are assigned to users are based on a matching list. A malicious attacker can delete matching rules from the list by getting the administrator's browser to make a...

PT-2013-5218

Name of the Vulnerable Software and Affected Versions HP IceWall SSO versions 8.0 through 10.0 HP IceWall SSO Agent Option versions 8.0 through 10.0 HP IceWall SSO Smart Device Option version 10.0 HP IceWall SSO SAML2 Agent Option version 8.0 HP IceWall SSO JAVA Agent Library versions 8.0 through...

CVE-2013-4820: Undefined Security Weakness

Unspecified vulnerability in HP IceWall SSO 8.0 through 10.0, IceWall SSO Agent Option 8.0 through 10.0, IceWall SSO Smart Device Option 10.0, IceWall SSO SAML2 Agent Option 8.0, IceWall SSO JAVA Agent Library 8.0 through 10.0, IceWall Federation Agent 3.0, and IceWall File Manager 3.0 through SP...

SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation

The Shibboleth authentication module provides user authentication and authorisation based on the Shibboleth Web Single Sign-on system. The module does not properly handle the changes of the underlying Shibboleth session. This can result in impersonation and possible privilege escalation if a user...