Ability to have the Websudo functionality working with SAML / SSO

h3. Problem Definition When implementing SAML either through JDC or through a vendor plugin, the net result is you have to turn off websudo because you can't get websudo and SAML to work. The effect is you can go straight into administration functions without confirmation that you should. This...

Ability to have the Websudo functionality working with SAML / SSO

h3. Problem Definition When implementing SAML either through JDC or through a vendor plugin, the net result is you have to turn off websudo because you can't get websudo and SAML to work. The effect is you can go straight into administration functions without confirmation that you should. This...

Input validation

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

CVE-2019-1714

A vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated,...

CVE-2019-1714

CVE-2019-1714 affects Cisco ASA and Cisco Firepower Threat Defense (FTD) software, where the SAML 2.0 SSO implementation has improper credential handling for NTLM or basic authentication. An unauthenticated, remote attacker could open a VPN session after another user has authenticated via SAML SS...

[SECURITY] Fedora 30 Update: signon-glib-2.1-4.fc30

This project is a library for managing single signon credentials which can be used from GLib applications. It is effectively a GLib binding for the D-Bus API provided by signond. It is part of the accounts-sso project...

Synology SSO Server Clickjacking Vulnerability

Synology SSO Server is a server software from Synology Inc. of Taiwan, China that provides single sign-on functionality. A security vulnerability exists in the SSOOauth.cgi file in Synology SSO Server versions prior to 2.1.3-0129. A remote attacker can conduct clickjacking attacks via unspecified...

CVE-2019-1003099

A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpldoValidate form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

Synology DiskStation Manager Cross-Site Scripting Vulnerability (CNVD-2019-08963)

Synology DiskStation Manager DSM is an operating system for use on Network Storage Servers NAS from Synology Inc. of Taiwan, China. This operating system manages information such as data, files, photos, music, and more. A cross-site scripting vulnerability exists in the Control Panel SSO setting ...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

CVE-2017-16775

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

Input validation

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2017-16775

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2018-13293

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

CVE-2018-13293

CVE-2018-13293 affects Synology DiskStation Manager (DSM) Control Panel SSO Settings prior to 6.2.1-23824. The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users to inject arbitrary web script or HTML via a URL parameter. Evidence across multiple sources con...

CVE-2017-16775

Improper restriction of rendered UI layers or frames vulnerability in SSOOauth.cgi in Synology SSO Server before 2.1.3-0129 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2017-16775

CVE-2017-16775 affects Synology SSO Server prior to 2.1.3-0129 via the SSOOauth.cgi component, where improper restriction of rendered UI layers or frames enables remote clickjacking. Exploitation details/vectors are not specified in the provided documents. Impact is described as allowing a clickj...

CVE-2018-13293: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Control Panel SSO Settings in Synology DiskStation Manager DSM before 6.2.1-23824 allows remote authenticated users to inject arbitrary web script or HTML via the URL parameter...

PT-2019-8139

Name of the Vulnerable Software and Affected Versions Synology SSO Server versions prior to 2.1.3-0129 Description The issue is related to an improper restriction of rendered UI layers or frames in SSOOauth.cgi, allowing remote attackers to conduct clickjacking attacks. Recommendations For versio...