Issuer validation regression in Spring Cloud SSO Connector

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

CVE-2013-6739

IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855...

Security feature bypass

IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855...

CVE-2013-6739

IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855...

Who is doing what on your network?

Over the past few months, while talking to customers, the topic of Zero Trust Architecture keeps coming up. Seemingly everyone is thinking of implementing the model - which we fully encourage! One of the core components of the principle is the ability to inspect and log all network and system...

Session fixation

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

CVE-2018-0229

CVE-2018-0229 affects Cisco AnyConnect Secure Mobility Client, ASA, and FTD software configured for SAML 2.0-based SSO. Root cause: ASA/FTD fail to detect if an authentication request originates from the AnyConnect client, enabling a session-fixation path where a user’s IdP authentication token c...

SSO PassThrough is not working in Microsoft Edge Browser.

SSO Pass-through is not working in Microsoft Edge Browser...

Watchfulli SSO Plugin,1.2, Other

Watchfulli SSO Plugin, versions 1.2 and previous, Other Resolution: update to version 1.3 update notice: https://watchful.li/news-blog/news/new-watchful-clients-and-sso-plugin-enhance-encryption...

Spoofing

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

CVE-2018-1443

The CVE-2018-1443 issue affects IBM Security Access Manager (IAS) Appliance versions 9.0.0–9.0.4 and IBM Tivoli Federated Identity Manager (TFIM) versions 6.2, 6.2.1, and 6.2.2, due to an XML parsing vulnerability in the SAML-based SSO flow. An attacker with authenticated access could trick the S...

aai-logon.ethz.ch XSS vulnerability

Open Bug Bounty ID: OBB-568696 Description| Value ---|--- Affected Website:| aai-logon.ethz.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

CVE-2018-7211

CVE-2018-7211 affects iDashboards 9.6b where the SSO implementation relies on a weak obfuscation library, enabling MITM attackers to recover credentials. The vulnerability is described consistently across NVD/Red Hat records and related feeds; no exploit details or affected version ranges beyond ...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

Rockstar Games: SocialClub's Facebook OAuth Theft through Warehouse XSS.

In this report, the researcher was able to chain together 3 separate, minor bugs to create an exploit that was greater than the sum of its parts. This exploit could have potentially allowed attackers to steal OAuth tokens from users. The exploit chain involved taking advantage of our SSO between...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...