shibboleth-sp -- vulnerable to forged user attribute data

Shibboleth consortium reports: Shibboleth SP software vulnerable to additional data forgery flaws The XML processing performed by the Service Provider software has been found to be vulnerable to new flaws similar in nature to the one addressed in an advisory last month. These bugs involve the use...

Authentication bypass via incorrect XML canonicalization and DOM traversal

ruby-saml prior to version 1.7.0 is vulnerable to an authentication bypass via incorrect XML canonicalization and DOM traversal. Specifically, there are inconsistencies in handling of comments within XML nodes, resulting in incorrect parsing of the inner text of XML nodes such that any inner text...

VU#475445: SAML Authentication Bypass | Cloud Foundry

Severity Medium/Advisory Vendor Duo Security Description Multiple SAML libraries may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the...

Cross site scripting

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

CVE-2018-2371

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

CVE-2018-2371

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

CVE-2018-2371

CVE-2018-2371 affects SAP NetWeaver AS Java Web Application (SAML 2.0 SP) 7.50. The issue is insufficient encoding of user-controlled inputs, causing Cross-Site Scripting (XSS). CVSSv3 base 6.1 (NETWORK, LOW ATTACK COMPLEXITY, UI REQUIRED, CHANGED SCOPE; CONFIDENTIALITY/INTEGRITY LOW) and CVSSv2 ...

PT-2018-15504

Name of the Vulnerable Software and Affected Versions SAP Netweaver AS Java Web Application version 7.50 Description The SAML 2.0 service provider does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS issue. Recommendations For SAP Netweaver AS Java Web...

CVE-2018-2371: Improper Neutralization of Input During Web Page Generation

The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site Scripting XSS vulnerability...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

Input validation

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

CVE-2017-18122

CVE-2017-18122 describes a signature-validation bypass in SimpleSAMLphp (up to 1.14.16) where a Service Provider using SAML 1.1 would treat as valid an unsigned SAML response that contains more than one signed assertion, as long as at least one signature is valid. This can let an attacker imperso...

CVE-2017-18122: Improper Verification of Cryptographic Signature

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

PT-2018-6687

Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp versions prior to 1.14.17 Description: A signature-validation bypass issue was discovered in SimpleSAMLphp. This issue allows an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP, by sendi...

Configure StoreFront with OKTA

This article illustrates how to configure StoreFront to use OKTA for authentication using SAML metadata exchange...

bsso.blpprofessional.com XSS vulnerability

Open Bug Bounty ID: OBB-544218 Description| Value ---|--- Affected Website:| bsso.blpprofessional.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...