Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

GHSA-8JJF-W7J6-323C Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

XML Signature Wrapping

Samlify and express-saml2 are vulnerable to XML signature wrapping attacks. Attackers who observe SAML responses are able to add NameID's to the response without breaking the signature check. This could allow them to login as any user...

GHSA-7FPW-CFC4-3P2C Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

Elevation Of Privileges

passport-wsfed-saml2 is vulnerable to elevation of privileges. When a SAML identity provider doesn't sign the entire SAML response, attackers can change the NameIdentifier to login as a different user. The attacker needs either be able to intercept encrypted traffic and modify SAML responses on t...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

Design/Logic Flaw

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

The CVE pertains to the Auth0 passport-wsfed-saml2 library prior to version 3.0.5. The vulnerability allows an attacker to impersonate another user and potentially elevate privileges if the SAML identity provider signs only the Assertion (not the full SAML response). This root cause involves inco...

TIBCO tibbr Multiple Vulnerabilities

TIBCO tibbr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tibco:tibbr"; if description...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

Code injection

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530

CVE-2017-5530 affects the tibbr web server components in Tibco tibbr Community (5.2.1 and below; 6.0.0/6.0.1; 7.0.0) and tibbr Enterprise (same version range). The issue arises from SAML protocol handling errors that may allow authorized users to impersonate other users and escalate privileges. C...

CVE-2017-5530 SAML protocol handling errors in tibbr

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530: Undefined Security Weakness

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

PT-2017-16561

Name of the Vulnerable Software and Affected Versions tibbr Community versions 5.2.1 and below tibbr Community version 6.0.0 tibbr Community version 6.0.1 tibbr Community version 7.0.0 tibbr Enterprise versions 5.2.1 and below tibbr Enterprise version 6.0.0 tibbr Enterprise version 6.0.1 tibbr...