Design/Logic Flaw

An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges...

CVE-2020-10695

An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges...

CVE-2020-10695

CVE-2020-10695 describes an insecure modification flaw in the /etc/passwd file within the redhat-sso-7 container that allows an attacker with container access to modify /etc/passwd and escalate privileges. The Red Hat advisories RHSA-2020:5529 and RHSA-2020:5533 document this issue as affecting R...

GHSA-QQ5V-F4C3-395C Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2

Impact When using SSO with the Argo CD CLI, a malicious SSO provider could have sent specially crafted error message that would result in XSS on the client by means of executing arbitrary JavaScript code. We believe the exploitation of this vulnerability is only be possible when Argo CD is...

Possible XSS when using SSO with the CLI in github.com/argoproj/argo-cd/v2

Impact When using SSO with the Argo CD CLI, a malicious SSO provider could have sent specially crafted error message that would result in XSS on the client by means of executing arbitrary JavaScript code. We believe the exploitation of this vulnerability is only be possible when Argo CD is...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

Unspecified Vulnerability in JetBrains TeamCity (CNVD-2021-35236)

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in...

CVE-2021-31913

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirecturi were made during GitHub SSO token exchange...

Design/Logic Flaw

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirecturi were made during GitHub SSO token exchange...

CVE-2021-31913

In JetBrains TeamCity before 2020.2.3, insufficient checks of the redirecturi were made during GitHub SSO token exchange...

CVE-2021-31913

CVE-2021-31913 affects JetBrains TeamCity Server pre-2020.2.3, where insufficient checks of the redirect_uri occurred during GitHub SSO token exchange. Public sources (NVD, Red Hat, CNVD, Nessus references) confirm the issue and tie it to TeamCity versions before 2020.2.3. The JetBrains security ...

CVE-2021-29456 Authelia allows open redirects on the logout endpoint

Authelia is an open-source authentication and authorization server providing 2-factor authentication and single sign-on SSO for your applications via a web portal. In versions 4.27.4 and earlier, utilizing a HTTP query parameter an attacker is able to redirect users from the web application to an...

CVE-2021-29456

CVE-2021-29456 affects Authelia (open‑source authentication/SSO server). In versions ≤ 4.27.4, an HTTP query parameter permits open redirects to any external domain, enabling potential phishing by spoofing the initial URL. The vulnerability’s impact is limited to redirect behavior, not direct app...

CVE-2021-26582

A security vulnerability in HPE IceWall SSO Domain Gateway Option Dgfw module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting XSS...

CVE-2021-26582

A security vulnerability in HPE IceWall SSO Domain Gateway Option Dgfw module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting XSS...

CVE-2021-26582

A security vulnerability in HPE IceWall SSO Domain Gateway Option Dgfw module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting XSS...

Cross site scripting

A security vulnerability in HPE IceWall SSO Domain Gateway Option Dgfw module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting XSS...

CVE-2021-26582

A security vulnerability in HPE IceWall SSO Domain Gateway Option Dgfw module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting XSS...

CVE-2021-26582

The CVE-2021-26582 entry concerns HPE IceWall SSO Domain Gateway Option (Dgfw) module versions 10.0 on RHEL 5/6/7, 10.0 on HP-UX 11i v3, and 10.0/11.0 on Windows. The vulnerability is a remote cross-site scripting (XSS) issue, with the underlying details indicating a vulnerable component/function...

CVE-2021-3034

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on SSO integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the...