go-saml security vulnerability

go-saml is a sufficiently good SAML client library written in Go open-sourced by Robots and Pencils. A security vulnerability exists in go-saml that stems from an application contains a SAML authentication bypass vulnerability that could lead to an application authentication bypass using go-saml...

PT-2024-2007 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client affected versions not specified Description: A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection...

CVE-2023-48703: Improper Authentication

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

CVE-2024-20337: Improper Neutralization of CRLF Sequences

A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriage return line feed CRLF injection attack against a user. This vulnerability is due to insufficient validation of user-supplied input. An attacker could...

PT-2024-13626

Name of the Vulnerable Software and Affected Versions go-saml versions all known versions Description The go-saml library contains an authentication bypass issue due to the internal use of the xmlsec1 command line tool to verify SAML assertions without restricting the origin of the public key for...

CVE-2024-2005 SAML implementation allows privilege escalation

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised ...

CVE-2024-2005 SAML implementation allows privilege escalation

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised ...

CVE-2024-2005

CVE-2024-2005 affects Blue Planet products up to version 22.12 due to a misconfiguration in the SAML implementation that allows privilege escalation for systems using SAML authentication. The issue is addressed by software updates released by Blue Planet/Ciena; customers should upgrade to the lat...

CVE-2024-2005: Improper Privilege Management

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation. Only products using SAML authentication are affected. Blue Planet® has released software updates that address this vulnerability for the affected products. Customers are advised ...

CentOS: Security Advisory for open-vm-tools (CESA-2023:7279)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for open (SUSE-SU-2023:3507-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Missing Critical Step In Authentication

Central Dogma is vulnerable to Missing Critical Step in Authentication. The vulnerability is due accepting unsigned SAML messages assertions, logout requests, etc. as they are when using SAML as the authentication mechanism instead of rejecting them. An attacker can forge a SAML message to...

New Silver SAML Attack Evades Golden SAML Defenses in Identity Systems

Cybersecurity researchers have disclosed a new attack technique called Silver SAML that can be successful even in cases where mitigations have been applied against Golden SAML attacks. Silver SAML "enables the exploitation of SAML to launch attacks from an identity provider like Entra ID against...

CentOS 9 : open-vm-tools-12.2.5-2.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the open-vm- tools-12.2.5-2.el9 build changelog. - SAML token signature bypass rhel-9 CVE-2023-20900 Note that Nessus has not tested for this issue but has instead relied only on the...

Authentication Bypass

com.linecorp.armeria: armeria-saml is vulnerable to Authentication Bypass. The vulnerability is due to improper filtering of SAML messages, allowing attackers to craft malicious messages to bypass authentication functionality...

GHSA-HX5Q-V6PJ-533R SAML authentication bypass due to missing validation on unsigned SAML messages

Impact When SAML is used as the authentication mechanism, Central Dogma accepts unsigned SAML messages assertions, logout requests, etc. as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an...

SAML authentication bypass due to missing validation on unsigned SAML messages

Impact When SAML is used as the authentication mechanism, Central Dogma accepts unsigned SAML messages assertions, logout requests, etc. as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an...

Armeria SAML authentication bypass due to missing validation on unsigned SAML messages

Impact The SAML implementation provided by armeria-saml currently accepts unsigned SAML messages assertions, logout requests, etc. as they are, rather than rejecting them by default. As a result, an attacker can forge a SAML message to authenticate themselves, despite the fact that such an unsign...

CVE-2024-1735

A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later...

Authentication flaw

A vulnerability has been identified in armeria-saml versions less than 1.27.2, allowing the use of malicious SAML messages to bypass authentication. All users who rely on armeria-saml older than version 1.27.2 must upgrade to 1.27.2 or later...