CVE-2015-0367: Undefined Security Weakness

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect integrity via vectors related to SSO Engine...

PT-2015-4582

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 11.1.1.5, 11.1.1.7, 11.1.2.1, 11.1.2.2 Description The issue affects the integrity of the system, allowing remote attackers to exploit it via vectors related to SSO Engine. Recommendations For versions 11.1.1.5,...

Improper Authentication in LDAP / SSO Authentication (ig_ldap_sso_auth)

It has been discovered that the extension "LDAP / SSO Authentication" igldapssoauth is susceptible to Improper Authentication. Release Date: January 8, 2015 Bulletin Update: January 8, 2015 Affected Versions, Severity; February 23, 2015 added CVE Component Type: Third party extension. This...

Ex Libris Patron Directory Services 2.1 Cross Site Scripting

CVE-2014-7293 Ex Libris Patron Directory Services PDS XSS Cross-Site Scripting Security Vulnerability Exploit Title: Ex Libris Patron Directory Services PDS Logon Page url Parameter XSS Product: Ex Libris Patron Directory Services PDS Vendor: Ex Libris Vulnerable Versions: 2.1 and probability pri...

PingFederate 6.10.1 SP Endpoints Open Redirect

CVE-2014-8489 Ping Identity Corporation "PingFederate 6.10.1 SP Endpoints" Dest Redirect Privilege Escalation Security Vulnerability Exploit Title: "Ping Identity Corporation" "PingFederate 6.10.1 SP Endpoints" Dest Redirect Privilege Escalation Security Vulnerability Product: PingFederate 6.10.1...

Design/Logic Flaw

The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service component hang via unspecified vectors...

CVE-2014-4809: Undefined Security Weakness

The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote attackers to cause a denial of service component hang via unspecified vectors...

PT-2014-6129

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web versions 7.x before 7.0.0-ISS-WGA-IF0009 IBM Security Access Manager for Web versions 8.x before 8.0.0-ISS-WGA-FP0005 Description The issue allows remote attackers to cause a denial of service, resulting in ...

Cisco Unified Communications Manager 'CTIManager' Remote Command Execution (CSCum95491)

According to its self-reported version, the remote Cisco Unified Communications Manager CUCM device has a flaw in the 'CTIManager' module that allows a remote, authenticated attacker to execute arbitrary commands with elevated privileges by using a specially crafted SSO token. %NASLMINLEVEL 70300...

CVE-2014-3338

The CTIManager module in Cisco Unified Communications Manager CM 10.01, when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491...

CVE-2014-3338

The CVE-2014-3338 issue affects Cisco Unified Communications Manager (CM) CTIManager. When single sign-on is enabled, Kerberos SSO tokens are not properly validated, allowing a remote authenticated attacker to execute arbitrary commands with elevated privileges using crafted token data (Bug CSCum...

CVE-2014-3338

The CTIManager module in Cisco Unified Communications Manager CM 10.01, when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491...

PT-2014-5230

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager version 10.01 Description The issue concerns the CTIManager module in Cisco Unified Communications Manager. When single sign-on is enabled, it does not properly validate Kerberos SSO tokens. This allows...

CVE-2014-3338: Improper Input Validation

The CTIManager module in Cisco Unified Communications Manager CM 10.01, when single sign-on is enabled, does not properly validate Kerberos SSO tokens, which allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data, aka Bug ID CSCum95491...

Cisco Unified Communications Manager CTIManager Vulnerability

A vulnerability in the CTIManager module of Cisco Unified Communications Manager Cisco Unified CM could allow an authenticated, remote attacker to execute arbitrary commands with elevated privileges. The vulnerability is due to a failure to properly validate input contained within Kerberos single...

Plesk 10.4.4/11.0.9 - SSO XXE/XSS Injection Exploit

No description provided by source...

McAfee Asset Manager 6.6 - Multiple Vulnerabilities

No description provided by source. Cloud SSO is vuln to unauthed XSS in the authentication audit form: https://twitter.com/BrandonPrry/status/445969380656943104 McAfee Asset Manager v6.6 multiple vulnerabilities http://www.mcafee.com/us/products/asset-manager.aspx Authenticated arbitrary file rea...

[security bulletin] HPSBMU03048 rev.1 - HP Software Executive Scorecard, Remote Execution of Code, Directory Traversal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c04341295 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04341295 Version: 1 HPSBMU03048 rev....

Plesk 10.4.4/11.0.9 - SSO XXE/XSS Injection Exploit

Exploit for aix platform in category web applications Exploit Title: Plesk SSO XXE injection Old bug Exploit Date: 12 06 2014 Exploit Author: z00 Software Link: http://www.parallels.com/ Version: 11.0.9 10.4.4 Tested on: linux all ?php / ████████████████████████████ █¶¶¶¶¶¶█ █¶¶¶¶¶¶¶¶¶¶█...

Plesk 10.4.411.0.9 - SSO XML External Entity Cross-Site Scripting Injection

Plesk 10.4.411.0.9 - SSO XML External Entity Cross-Site Scripting Injection Exploit Title: Plesk SSO XXE injection Old bug Exploit Date: 12 06 2014 Exploit Author: z00 Software Link: http://www.parallels.com/ Version: 11.0.9 10.4.4 Tested on: linux all ?php / ████████████████████████████ █¶¶¶¶¶¶█...