org.keycloak:keycloak-account-freemarker (1.4.0.final), org.keycloak:keycloak-broker-oidc (1.4.0.final) +8 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (1.4.0.final)

org.keycloak:keycloak-services MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.4.0.final - org.keycloak:keycloak-broker-oidc...

VMware vCenter Forge SAML Authentication Credentials

This module forges valid SAML credentials for vCenter server using the vCenter SSO IdP certificate, IdP private key, and VMCA certificates as input objects; you must also provide the vCenter SSO domain name and vCenter FQDN. The module will return a session cookie for the /ui path that grants...

VMware vCenter Secrets Dump

Grab secrets and keys from the vCenter server and add them to loot. This module is tested against the vCenter appliance only; it will not work on Windows vCenter instances. It is intended to be run after successfully acquiring root access on a vCenter appliance and is useful for penetrating furth...

Citrix StoreFront Security Bulletin for CVE-2022-27503

A reflected cross-site scripting XSS issue has been discovered in Citrix StoreFront when it is configured to use SAML authentication. If exploited, this issue would allow an attacker to execute client-side JavaScript in the same context as a legitimate user. This issue has the following identifie...

GitLab: Content injection in Jira issue title enabling sending arbitrary POST request as victim

Summary The issue described here leads to the same outcome as my previous report, https://hackerone.com/reports/1409788 . So look into that one for further details on the JavaScript gadgets. Also see my report https://hackerone.com/reports/1481207 for a detailed rundown of injections in GitLab...

CVE-2022-1162

GitLab CVE-2022-1162 affects GitLab CE/EE versions 14.7 before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. Root cause: a hardcoded password was set for accounts registered via OmniAuth providers (OAuth, LDAP, SAML), enabling potential account takeover. Impact: high-risk credential exposur...

GHSA-CM29-6WX7-P874 Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

Keycloak insufficient session expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2021-3461

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2021-3461

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

Cross site request forgery (csrf)

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2021-3461

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2021-3461

CVE-2021-3461 affects Keycloak and describes a flaw where Keycloak may fail to logout a user session when a logout request originates from an external SAML identity provider and the Principal Type is set to Attribute [Name]. The Connected documents corroborate this exact issue across multiple adv...

PT-2022-10373

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Red Hat Single Sign-On affected versions not specified Description A flaw was found in Keycloak where it may fail to logout a user session if the logout request comes from an external SAML identity...

CVE-2021-3461: Insufficient Session Expiration

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

CVE-2022-26951

Archer 6.x through 6.10 6.10.0.0 contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...

Cross site scripting

Archer 6.x through 6.10 6.10.0.0 contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...

CVE-2022-26951

Archer 6.x through 6.10 6.10.0.0 contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...

PT-2022-18137

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.10 Description The issue is a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

CVE-2022-26951: Improper Neutralization of Input During Web Page Generation

Archer 6.x through 6.10 6.10.0.0 contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...