5321 matches found
CVE-2024-8698
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
CVE-2024-8698
CVE-2024-8698 affects Keycloak’s SAML signature validation in the XMLSignatureUtil class. The vulnerability stems from misclassifying a signature as applying to the full document versus only to specific assertions based on signature position, not the referenced element, enabling crafted SAML resp...
CVE-2024-8698
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
CVE-2024-8698 Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
CVE-2024-8698 Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
CVE-2024-8698
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
GitLab Patches Critical SAML Authentication Bypass Flaw in CE and EE Editions
GitLab has released patches to address a critical flaw impacting Community Edition CE and Enterprise Edition EE that could result in an authentication bypass. The vulnerability is rooted in the ruby-saml library CVE-2024-45409, CVSS score: 10.0, which could allow an attacker to log in as an...
RHEL 7 : Red Hat Single Sign-On 7.6.11 security update on RHEL 7 (Important) (RHSA-2024:6878)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6878 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...
CVE-2024-8698: Improper Verification of Cryptographic Signature
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...
RHEL 9 : Red Hat Single Sign-On 7.6.11 security update on RHEL 9 (Important) (RHSA-2024:6880)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6880 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...
RHEL 8 : Red Hat Single Sign-On 7.6.11 security update on RHEL 8 (Important) (RHSA-2024:6879)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6879 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...
FreeBSD : Gitlab -- vulnerabilities (3e738678-7582-11ef-bece-2cf05da270f3)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 3e738678-7582-11ef-bece-2cf05da270f3 advisory. Gitlab reports: SAML authentication bypass Tenable has extracted the preceding description block direct...
Red Hat Keycloak 数据伪造问题漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A Data Forgery Issue vulnerability exists in Red Hat Keycloak versions prior to 25.0.6, which stems from a flaw in the SAML signature validatio...
Exploit for Authentication Bypass by Spoofing in Zabbix
CVE-2022-23131 Zabbix SAML Authentication Exploit This Python...
keycloak:SamlMetadataParserFuzzer: Security exception in com.ctc.wstx.util.WordResolver$Builder.constructBranch
Detailed Report: https://oss-fuzz.com/testcase?key=6071792907649024 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlMetadataParserFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
Gitlab -- vulnerabilities
Gitlab reports: SAML authentication bypass...
CVE-2024-6582 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...
PT-2024-37736 · Lunary · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 Description: A broken access control issue exists in the saml.ts file, allowing a user from one organization to update the Identity Provider IDP settings and...
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in = v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the...
GHSA-CVP8-5R8G-FHVQ omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in = v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the...