sso.garmin.com Open Redirect vulnerability

Vulnerable URL: https://sso.garmin.com/sso/login?service=https://www.openbugbounty.org=olaxpw-conctmodern008=true Details: Description| Value ---|--- Patched:| Yes, at 23.08.2017 Latest check for patch:| 23.08.2017 11:55 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

CVE-2016-3687

Summary (CVE-2016-3687) Open redirect vulnerability in F5 BIG-IP APM (multi‑domain SSO) and BIG-IP Edge Gateway, caused by insufficient validation of the SSO_ORIG_URI parameter. Affected: BIG-IP APM 11.4.0–11.6.0 (and 11.2.1); Edge Gateway 11.2.1. Attacker can craft base64‑encoded SSO_ORIG_URI to...

PT-2016-5659

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 F5 Edge Gateway version 11.2.1 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved vi...

F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (K26738102)

Insufficient validation of the SSOORIGURI parameter occurs when using multi-domain single sign-on SSO. CVE-2016-3687 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution K26738102. The text description of this plug...

OneLogin SAML SSO <= 2.1.5 - Authentication Bypass

The OneLogin SAML SSO WordPress plugin was affected by an Authentication Bypass security vulnerability...

WordPress OneLogin SAML SSO Plugin <= 2.1.8 - Privilege Escalation

This plugin is prone to a privilege escalation vulnerability. Solution Update the plugin...

WordPress OneLogin SAML SSO Plugin <= 2.1.5 - Authentication Bypass

This plugin has a bug which allows anyone to login without a password or other authentication. Solution Update the plugin...

OneLogin SAML SSO <= 2.1.8 - Provisioned User Hardcoded Password

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability...

myratner.com XSS vulnerability

Vulnerable URL: https://myratner.com/sso/SSOServlet?locale=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5405067 VIP website...

careers.everettclinic.com XSS vulnerability

Vulnerable URL: https://careers.everettclinic.com/sso/SSOServlet?locale=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown /...

azstatejobs.azdoa.gov XSS vulnerability

Vulnerable URL: https://azstatejobs.azdoa.gov/sso/SSOServlet?locale=" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check azstatejobs.azdoa.gov SSL connection:|...

sso.amerisourcebergen.com XSS vulnerability

Vulnerable URL: https://sso.amerisourcebergen.com/oaamserver/?app=...

Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...

F5 BIG-IP - BIG-IP APM SSO vulnerability CVE-2016-3686

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

Ubiquiti Inc.: Reflected XSS in scores.ubnt.com

Parameter p in https://scores.ubnt.com/form.html?uid=1&p=airFiber is vulnerable to XSS. If a user logs in at https://account.ubnt.com/login and visits https://scores.ubnt.com/form.html?uid=1&p=airFiber"alertdocument.cookie;, a message box will be presented with his cookie. Attached is a POC...

CVE-2016-3686

The CVE-2016-3686 issue affects F5 BIG-IP APM SSO (and BIG-IP Edge Gateway) where Cleartext SessionID can appear in the Location header during redirects. Affected are BIG-IP APM 11.0.0–11.6.0 (HF6 in 11.6.0) and BIG-IP Edge Gateway 11.0.0–11.3.0; other components are listed as affected/not vulner...

F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (SOL82679059)

Cleartext SessionID is visible in URL query parameters under some conditions. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL82679059. The text description of this plugin is C F5 Networks...

PT-2016-5658

Name of the Vulnerable Software and Affected Versions F5 BIG-IP APM versions 11.x before 11.6.0 HF6 F5 BIG-IP Edge Gateway versions 11.0.0 through 11.3.0 Description The Single Sign-On SSO feature might allow remote attackers to obtain sensitive SessionId information by leveraging access to the...

ssologin.inbcu.com XSS vulnerability

Vulnerable URL: https://ssologin.inbcu.com/ssologin/ssologin.jsp?TYPE=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0...

SOL82679059 - BIG-IP APM SSO vulnerability CVE-2016-3686

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...