Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...

F5 BIG-IP - BIG-IP APM SSO vulnerability CVE-2016-3686

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

Ubiquiti Inc.: Reflected XSS in scores.ubnt.com

Parameter p in https://scores.ubnt.com/form.html?uid=1&p=airFiber is vulnerable to XSS. If a user logs in at https://account.ubnt.com/login and visits https://scores.ubnt.com/form.html?uid=1&p=airFiber"alertdocument.cookie;, a message box will be presented with his cookie. Attached is a POC...

CVE-2016-3686

The CVE-2016-3686 issue affects F5 BIG-IP APM SSO (and BIG-IP Edge Gateway) where Cleartext SessionID can appear in the Location header during redirects. Affected are BIG-IP APM 11.0.0–11.6.0 (HF6 in 11.6.0) and BIG-IP Edge Gateway 11.0.0–11.3.0; other components are listed as affected/not vulner...

F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (SOL82679059)

Cleartext SessionID is visible in URL query parameters under some conditions. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL82679059. The text description of this plugin is C F5 Networks...

ssologin.inbcu.com XSS vulnerability

Vulnerable URL: https://ssologin.inbcu.com/ssologin/ssologin.jsp?TYPE=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0...

SOL82679059 - BIG-IP APM SSO vulnerability CVE-2016-3686

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...

SSO Wallpapers - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application SSO Wallpapers published at the 'play' market has multiple vulnerabilities...

TrendMicro SSO Redirect / Session Theft

Document Title: =============== Trend Micro SSO - Backend SSO Redirect & Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1694 Trand Micro ID: 1-1-1035080936 Release Date: ============= 2016-03-31 Vulnerability Laboratory ID VL-ID:...

Trend Micro (SSO) - SSO Redirect & Session Vulnerability

Document Title: =============== Trend Micro SSO - SSO Redirect & Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1694 Trand Micro ID: 1-1-1035080936 Release Date: ============= 2016-03-31 Vulnerability Laboratory ID VL-ID:...

Trend Micro (SSO) - SSO Redirect & Session Vulnerability

Document Title: =============== Trend Micro SSO - SSO Redirect & Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1694 Trand Micro ID: 1-1-1035080936 Release Date: ============= 2016-03-30 Vulnerability Laboratory ID VL-ID:...

SUSE-SU-2016:0905-1 Security update for samba

This update for samba fixes the following issues: Security issue fixed: - CVE-2015-7560: Getting and setting Windows ACLs on symlinks can change permissions on link target; bso11648; bsc968222. Bugs fixed: - Fix leaking memory in libsmbclient: Add missing talloc stackframe; bso11177; bsc967017. -...

CVE-2015-6854

CA Single Sign-On (SSO) non-Domino Web Agent affected across multiple releases: R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5. The issue allows remote attackers to trigger a denial of service (daemon crash) or access sensitive information via a crafted request. Root cau...

CVE-2015-6853

Technical details about CVE-2015-6853 are not publicly provided in the supplied documents; sources largely reiterate the vulnerability exists and can cause DoS or information disclosure. Monitor for updates.

Responses with Set-Cookie header cached

h3. Context We have Jira running with SSO from Crowd. Jira is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get the Crowd...

Responses with Set-Cookie header cached

h3. Context We have Jira running with SSO from Crowd. Jira is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get the Crowd...

Responses with Set-Cookie header cached

h3. Context We have Confluence running with SSO from Crowd. Confluence is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get...

Responses with Set-Cookie header cached

h3. Context We have Confluence running with SSO from Crowd. Confluence is behind a corporate reverse proxy from BlueCoat which has caching enabled but respects the Cache-control, Expire and Pragma HTTP headers. h3. Problem We have discovered following cases of sessions mix up where a user \1 get...

Moderate: Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update

Red Hat JBoss Fuse 6.2.1 Rollup Patch 1, which fixes one security issue and includes several bug fixes and various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring...

OpenAM Open Redirect

COMPASS SECURITY ADVISORY http://www.csnc.ch/en/downloads/advisories.html CSNC ID: CSNC-2016-002 Product: OpenAM 1 Vendor: ForgeRock Subject: Open Redirect Risk: Critical Effect: Remotely exploitable Author: Stephan Sekula [email protected] Date: February 23rd 2016 Introduction: ------------...