CVE-2023-45683: Improper Neutralization of Input During Web Page Generation

github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the...

Fortinet Fortigate xss (FG-IR-23-104)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-104 advisory. - An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an...

Malicious code in saml-mock-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b6618e14c994ca30eee3c7d8c84f92b58ccbe4fc602db2de0bc515db275162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8332 Malicious code in saml-mock-idp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b6618e14c994ca30eee3c7d8c84f92b58ccbe4fc602db2de0bc515db275162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-36555

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

Design/Logic Flaw

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

CVE-2023-36555

CVE-2023-36555 is an XSS vulnerability in Fortinet FortiOS 7.2.0–7.2.4 where improper neutralization of script-related HTML tags in the FortiSAML/Security Fabric context can allow a remote attacker to run unauthorized code via crafted requests. The CVE entry is corroborated by multiple sources (N...

CVE-2023-36555

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

CVE-2023-36555

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

HTML injection in SAML and Security Fabric components

...

CVE-2023-36555: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

An improper neutralization of script-related html tags in a web page basic xss in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to execute unauthorized code or commands via the SAML and Security Fabric components...

PT-2023-6003

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.2.0 through 7.2.4 Description The issue is related to an improper neutralization of script-related HTML tags in a web page, which can allow an attacker to execute unauthorized code or commands. This can be achieved...

UI Redressing (Clickjacking) with SSO Plugin for Data Center

h3. Problem Related to CONFSERVER-29230 When we enable the SAML login on General Configuration - Authentication, the Confluence login page shows inside an iframe. When disabled it doesn't show as expected with the Clickjacking disabled by default. In the gif attached, replicated the error on our...

The vulnerability of the application-specific SAML interface of the Cisco Catalyst SD-WAN Manager centralized network management system allows a perpetrator to gain access to the application.

The vulnerability of the application software interface for the Single Sign-On module of the Cisco Catalyst SD-WAN Manager centralized network management system is related to errors during authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain access to the...

Cisco Catalyst SD-WAN Manager Unauthorized Access Vulnerability

Cisco vManage is a highly customizable control panel that simplifies and automates Cisco SD-WAN deployment, configuration, management and operations. An unauthorized access vulnerability exists in Cisco Catalyst SD-WAN Manager in versions 20.9.3.2 and 20.11.1.2. The vulnerability is due to failur...

Authentication flaw

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-20252

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-20252

CVE-2023-20252 affects Cisco Catalyst SD-WAN Manager (Cisco vManage) SAML API authentication. Root cause: improper authentication checks in SAML API endpoints allow unauthenticated remote attackers to obtain an authorization token and gain access as an arbitrary user. Impact: high – remote unauth...

CVE-2023-20252

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...

CVE-2023-20252: Missing Authorization

A vulnerability in the Security Assertion Markup Language SAML APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to improper authentication checks for SAML...