4906 matches found
CVE-2022-26155
An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body...
Exploit for Authentication Bypass by Spoofing in Zabbix
CVE-2022-23131 Zabbix - SAML SSO Authentication Bypass Des...
Zabbix 5.4.x < 5.4.9 Multiple Vulnerabilities
According to its self-reported version number, the instance of Zabbix running on the remote host is 5.4.x prior to 5.4.9. It is, therefore, affected by multiple vulnerabilities: - In the case of instances where the SAML SSO authentication is enabled non-default, session data can be modified by a...
Cherwell Service Management 跨站脚本漏洞
Cherwell Service Management is a comprehensive service desk solution from Cherwell USA, validated against 11 ITIL® processes. Meet the changing and growing needs of your entire organization with less hassle and lower costs. A cross-site scripting vulnerability exists in Cherwell Service Managemen...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
Design/Logic Flaw
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
CVE-2022-25262
JetBrains Hub exposes a SAML request takeover vulnerability (CVE-2022-25262) in Hub versions before 2022.1.14434. Root cause: insufficient verification/handling of SAML requests, enabling takeover of SAML responses. Affects Hub’s SAML OAuth2->SAML exchange and may allow an attacker to misuse a...
CVE-2022-25262
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
PT-2022-3565 · Jetbrains · Jetbrains Hub
Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2022.1.14434 Description: The issue is related to insufficient authentication data verification in JetBrains Hub, allowing a remote attacker to exploit the vulnerability and gain access to confidential data,...
CVE-2022-25262: Insufficient Verification of Data Authenticity
In JetBrains Hub before 2022.1.14434, SAML request takeover was possible...
CISA Alerts on Actively Exploited Flaws in Zabbix Network Monitoring Platform
The U.S. Cybersecurity and Infrastructure Security Agency CISA has warned of active exploitation of two security flaws impacting Zabbix open-source enterprise monitoring platform, adding them to its Known Exploited Vulnerabilities Catalog. On top of that, CISA is also recommending that Federal...
Exploit for Authentication Bypass by Spoofing in Zabbix
Zabbix SAML SSO Login Bypass Vulnerability CVE-2022-23131 Env...
Zabbix Frontend Authentication Bypass Vulnerability
Unsafe client-side session storage leading to authentication bypass/instance takeover via Zabbix Frontend with configured SAML...
Authentication Bypass
github.com/fleetdm/fleet, is vulnerable to authentication bypass. The vulnerability exists due to stdlib XML parsing in the validate.go file and valid SAML response allowing an attacker to modify the trusted document and cause unauthorized login through SAML IdP...
SAML authentication vulnerability due to stdlib XML parsing
Impact Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. Patches This iss...
GHSA-W3WF-CFX3-6GCX SAML authentication vulnerability due to stdlib XML parsing
Impact Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. Patches This iss...
GHSA-XHQQ-X44F-9FGG Authentication Bypass in github.com/russellhaering/gosaml2
Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...
Authentication Bypass in github.com/russellhaering/gosaml2
Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users...
GlobalProtect App: Privilege Escalation Vulnerability When Using Connect Before Logon With SAML Authentication
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app when the feature is configured to use SAML authentication that enables a local attacker to escalate to SYSTEM or root privileges when...