PT-2017-8759

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before HF 1 NetIQ Access Manager versions 4.2 through 4.2.2 Description The issue allows for local file disclosure via an XML External Entity XXE attack due to the parsing of incoming SAML reques...

Nextcloud: Update php-saml library to 2.10.5

The php-saml library as used by our SSO implementation had a minor security patch in 2.10.4 as per https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1. So we should update this in our next minor releases. Security update for signature validation on...

Information disclosure

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

CVE-2015-6671

Open edX edx-platform pre-2015-08-25 stores SAML SSO secrets in the database, enabling potential exposure of sensitive information via a database backup. The root cause is storage of SAML secrets in the database, which means that if a backup is accessed, context-dependent attackers may obtain sen...

CVE-2015-6671

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

How to Deploy and Troubleshoot ADC as a SAML IdP or SP

SAML is an authentication method which allows the Client to authenticate to a trusted third party before accessing protected resources. For a SAML setup, the authenticating party is called the Identity Provider IdP and the resource that the user is trying to access is called the Service Provider...

PT-2017-7047

Name of the Vulnerable Software and Affected Versions edx-platform versions prior to 2015-08-25 Description The issue allows context-dependent attackers to obtain sensitive information by leveraging access to a database backup, as the database is used for storage of SAML SSO secrets...

CVE-2015-6671: Exposure of Sensitive Information to an Unauthorized Actor

Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup...

Xxe

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

PYSEC-2017-67

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

DEBIAN-CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

CVE-2016-10127 affects PySAML2 and is an XML External Entity (XXE) vulnerability in SAML XML processing. The issue arises from how the library parses crafted SAML requests/responses, enabling potential data disclosure or other XXE consequences as described in connected sources. The CVE entry also...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

CVE-2016-10127: Improper Restriction of XML External Entity Reference

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...