5286 matches found
CVE-2016-5751
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials...
CVE-2016-5752
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester...
CVE-2016-5751
CVE-2016-5751 affects NetIQ Access Manager Identity Server SAML processing: an unfiltered finalizer target URL can be exploited to trigger XSS and leak authentication credentials. Affected products/versions: NetIQ Access Manager 4.1 prior to 4.1.2 HF1, and 4.2 prior to 4.2.2. Root cause: unfilter...
CVE-2016-5751: Improper Neutralization of Input During Web Page Generation
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials...
PT-2017-8759
Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before HF 1 NetIQ Access Manager versions 4.2 through 4.2.2 Description The issue allows for local file disclosure via an XML External Entity XXE attack due to the parsing of incoming SAML reques...
PT-2017-8761
Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before HF1 NetIQ Access Manager versions 4.2 through 4.2.2 Description The issue is related to an unfiltered finalizer target URL in the SAML processing feature of Identity Server. This could...
F5 Networks BIG-IP : TMM SSO plugin vulnerability (K95444512)
The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...
Nextcloud: Update php-saml library to 2.10.5
The php-saml library as used by our SSO implementation had a minor security patch in 2.10.4 as per https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1. So we should update this in our next minor releases. Security update for signature validation on...
Information disclosure
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...
CVE-2015-6671
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...
CVE-2015-6671
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...
CVE-2015-6671
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...
CVE-2015-6671
Open edX edx-platform pre-2015-08-25 stores SAML SSO secrets in the database, enabling potential exposure of sensitive information via a database backup. The root cause is storage of SAML secrets in the database, which means that if a backup is accessed, context-dependent attackers may obtain sen...
How to Deploy and Troubleshoot ADC as a SAML IdP or SP
SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...
PT-2017-7047
Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-08-25 Description The issue allows context-dependent attackers to obtain sensitive information by leveraging access to a database backup, as the database is used for storage of SAML SSO secrets...
CVE-2015-6671: Exposure of Sensitive Information to an Unauthorized Actor
Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...
Xxe
PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...
PYSEC-2017-67
PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...
