Authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

CVE-2015-0277

CVE-2015-0277 affects Red Hat JBoss PicketLink (SP/IdP) prior to 2.7.0. The flaw is failure to ensure the SP is a member of an Audience when an AudienceRestriction is specified, enabling a remote attacker to log in to other users’ accounts via a crafted SAML assertion. Related issue CVE-2015-6254...

DLA-290-2 opensaml2 - security update

Bulletin has no description...

DLA-290-1 xmltooling - security update

Bulletin has no description...

PT-2015-4918

Name of the Vulnerable Software and Affected Versions XMLTooling-C versions prior to 1.5.5 OpenSAML-C affected versions not specified Shibboleth Service Provider SP affected versions not specified Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by...

FreeBSD : shibboleth-sp -- DoS vulnerability (b202e4ce-3114-11e5-aa32-0026551a22dc)

Shibboleth consortium reports : Shibboleth SP software crashes on well-formed but invalid XML. The Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML...

EMC Document Sciences xPression SQL Injection Vulnerability

EMC Document Sciences is a customer communications management solution. A SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression versions 4.2, 4.5 SP1 can be exploited by remote attackers to access or modify information on an affected system by executing SQL comman...

The vulnerability of the MySQL database management system allows a remote attacker to cause a service failure.

The vulnerability in the MySQL database management system allows a malicious actor, who operates remotely and has completed the authentication process, to compromise data accessibility by using the Server:SP subcomponent...

Oracle MySQL Multiple Unspecified vulnerabilities-04 (Apr 2015) - Windows

Oracle MySQL is prone to multiple unspecified vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql";...

Unspecified Vulnerability in Oracle MySQL Server Server:SP Subcomponent

Oracle MySQL Server is an open source relational database management system. A security vulnerability exists in the Server:SP subcomponent of Oracle MySQL Server, which can be exploited by remote attackers to conduct denial of service attacks...

CVE-2015-0511

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP...

CVE-2015-0511

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP...

PT-2015-1127

Name of the Vulnerable Software and Affected Versions Oracle MySQL Server versions 5.6.23 and earlier Description The issue allows remote authenticated users to affect the availability of data through unknown vectors related to the Server: SP subcomponent. This may impact the system's ability to...

CVE-2015-0511: Undefined Security Weakness

Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP...

MySQL 5.5.x < 5.5.43 / 5.6.x < 5.6.24 Multiple DoS Vulnerabilities (April 2015 CPU)

The version of MySQL running on the remote host is version 5.5.x prior to 5.5.43 or version 5.6.x prior to 5.6.24. It is, therefore, potentially affected by unspecified flaws in the following MySQL subcomponents that allow a denial of service by an authenticated, remote attacker : - Replication...

WordPress SP Project & Document Manager 2.5.3 - Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage: http://smartypantsplugins.com...

Code injection

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

CVE-2015-2684 affects the Shibboleth Service Provider (SP) prior to version 2.5.4. It allows a remote authenticated attacker to cause a denial of service (crash) by sending crafted SAML messages; multiple sources confirm a fix involves upgrading/shifting to newer SP releases (e.g., 2.5.4+ and rel...

CVE-2015-2684

Removed by vendor...

WordPress Plugin SP Project Document Manager 2.5.3 - Blind SQL Injection

WordPress Plugin SP Project Document Manager 2.5.3 - Blind SQL Injection Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage:...