CVE-2025-6700 Xuxueli xxl-sso login cross site scripting

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to...

CVE-2025-6700 Xuxueli xxl-sso login cross site scripting

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to...

PT-2025-26989 · Xuxueli · Xuxueli Xxl-Sso

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue was found in the software, affecting the /xxl-sso-server/login file. The manipulation of the errorMsg argument leads to cross-site scripting. The attack can be initiated remotely...

CVE-2025-6700: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in Xuxueli xxl-sso 1.1.0. This vulnerability affects unknown code of the file /xxl-sso-server/login. The manipulation of the argument errorMsg leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to...

PT-2025-27000 · Xuxueli · Xuxueli Xxl-Sso

Name of the Vulnerable Software and Affected Versions: Xuxueli xxl-sso version 1.1.0 Description: A problematic issue has been found in the software, affecting the processing of the file /xxl-sso-server/doLogin. The manipulation of the redirect url argument leads to an open redirect. This issue c...

CVE-2025-6701: URL Redirection to Untrusted Site

A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-server/doLogin. The manipulation of the argument redirecturl leads to open redirect. The attack may be initiated remotely. The exploit has...

CVE-2025-20264

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...

CVE-2025-20264 Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...

CVE-2025-20264

Cisco ISE (Identity Services Engine) is affected by CVE-2025-20264, a vulnerability in the web-based management interface that allows an authenticated remote attacker to bypass authorization for specific administrative functions. The root cause is insufficient authorization enforcement for users ...

Cisco Identity Services Engine Authorization Bypass Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...

CVE-2025-20264: Improper Authorization

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...

Cisco Identity Services Engine (cisco-sa-ise-auth-bypass-mVfKVQAU)

According to its self-reported version, Cisco ISE is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative function...

PT-2025-26846 · Cisco · Cisco Identity Services Engine

Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the...

CVE-2025-32975

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid...

CVE-2025-32975: Improper Authentication

Quest KACE Systems Management Appliance SMA 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 Patch 5, and 14.1.x before 14.1.101 Patch 4 contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid...

CVE-2025-32975

Quest KACE Systems Management Appliance (SMA) versions prior to 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), and 14.1.101 (Patch 4) are affected by an authentication bypass vulnerability. The flaw exists within the SSO authentication handling mechanism , enabling attackers to impersonate legi...

Quest Software KACE Systems Management Appliance 安全漏洞

Quest Software KACE Systems Management Appliance Quest KACE SMA is an automated and simplified IT systems management platform from Quest Software, USA. A security vulnerability exists in the Quest Software KACE Systems Management Appliance that stems from a flaw in the SSO authentication handling...

CVE-2025-6003: Incorrect Authorization

The WordPress Single Sign-On SSO plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the .5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data...

ADC-13.1-How to support multiple domain SSO to StoreFront with user "distinguishedName" attribute

How to support multiple domain SSO to StoreFront from NetScaler with user "distinguishedName" attribute...

Malicious code in webmaker-sso (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1b71ddc7d061c8f7256f365a12a3d960f2fd6da0118ad1bc039beefa8387d9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...