PT-2015-5836

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider SP versions prior to 2.5.4 Description The issue allows remote authenticated users to cause a denial of service, resulting in a crash, by sending a crafted SAML message. Recommendations For versions prior to 2.5.4,...

Debian: Security Advisory (DSA-3207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache Axis2 <= 1.6.2 Multiple Vulnerabilities

Apache Axis2 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later CPE = "cpe:/a:apache:axis2"; if...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security and bug fix update

Red Hat JBoss Fuse and A-MQ 6.1.0 Rollup Patch 2 R2, which includes several bug fixes, enhancements, and resolves two security issues, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring...

Security: Wrong security context loaded when using SAML2 STS Login Module

It was found that when processing undefined security domains, the org.jboss.security.plugins.mapping.JBossMappingManager implementation would fall back to the default security domain if it was available. A user with valid credentials in the defined default domain, with a role that is valid in the...

Oracle OpenSSO SAML Multiple Vulnerabilities (January 2015 CPU)

The remote Oracle OpenSSO component in the Oracle Fusion Middleware install is missing a vendor-supplied security update. It is, therefore, affected by multiple unspecified vulnerabilities in the SAML subcomponent. Note that these vulnerabilities are unspecified by Oracle but appear to be...

Unspecified Vulnerability in Oracle OpenSSO SAML Subpart (CNVD-2015-00551)

OpenSSO project is an open source implementation of SSO Single Sign-On for Web applications deployed on different Web or different servers to provide centralized authentication capabilities . Oracle OpenSSO SAML subcomponent has a security vulnerability that allows remote attackers to exploit the...

Buffer overflow

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592...

CVE-2015-0389

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592...

CVE-2015-0389

CVE-2015-0389 affects the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5. The connected sources describe multiple unspecified vulnerabilities in the SAML subcomponent that could allow remote authenticated users to affect integrity. The reports consistently refer to Open...

Buffer overflow

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2015-0389...

CVE-2014-6592

Technical details for CVE-2014-6592 are not provided in the supplied connected documents; no affected products, root cause, or remediation are specified here. Monitor for updates from official sources to obtain concrete information.

CVE-2015-0389: Undefined Security Weakness

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592...

PT-2015-3900

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 8.0 Update 2 Patch 5 Description The issue affects the integrity of the system, related to SAML. It is a distinct problem from other known vulnerabilities. Recommendations For Oracle Fusion Middleware version 8...

PT-2015-4601

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware version 8.0 Update 2 Patch 5 Description The issue affects the integrity of the system, related to SAML. It is a distinct problem from other known vulnerabilities. Recommendations For Oracle Fusion Middleware version 8...

CVE-2014-6592: Undefined Security Weakness

Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2015-0389...

Updated cxf packages fix security vulnerabilities

Updated cxf packages fix security vulnerabilities: An Apache CXF JAX-RS service can process SAML tokens received in the authorization header of a request via the SamlHeaderInHandler. However it is possible to cause an infinite loop in the parsing of this header by passing certain bad values for t...

MGASA-2014-0557 Updated cxf packages fix security vulnerabilities

Updated cxf packages fix security vulnerabilities: An Apache CXF JAX-RS service can process SAML tokens received in the authorization header of a request via the SamlHeaderInHandler. However it is possible to cause an infinite loop in the parsing of this header by passing certain bad values for t...

Updated wss4j packages fix CVE-2014-3623

Updated wss4j packages fixes security vulnerability: Apache WSS4J before 1.6.17, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors CVE-2014-3623...

RHEL 5 / 6 / 7 : Red Hat JBoss Enterprise Application Platform 6.3.2 (RHSA-2014:2019)

The remote Redhat Enterprise Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:2019 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was...