Malicious code in sso-paypal (npm)

The package sso-paypal was found to contain malicious code...

MAL-2025-26121 Malicious code in mean-sso (npm)

The package mean-sso was found to contain malicious code...

MAL-2025-33882 Malicious code in sso (npm)

The package sso was found to contain malicious code...

Malicious code in express-sso (npm)

The package express-sso was found to contain malicious code...

MAL-2025-33883 Malicious code in sso-paypal (npm)

The package sso-paypal was found to contain malicious code...

CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler

An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...

CVE-2025-34142

CVE-2025-34142 : ETQ Reliance on the CG (legacy) platform is affected via the /resources/sessions/sso endpoint. The SAML handler processes XML without disabling external entity resolution, enabling XXE that could disclose sensitive files or enable SSRF. Remediation in the reports specifies disabl...

CVE-2025-34063

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-34063

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...

CVE-2025-34063 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key

A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...

CVE-2025-34062 OneLogin AD Connector API Credential and Signing Key Exposure

An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directorytoken—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext respon...

PT-2025-27568 · Iitb Sso · Iitb Sso

Name of the Vulnerable Software and Affected Versions: IITB SSO version 1.1.0 Description: The issue is related to misconfigured settings, allowing attackers to access sensitive application data. Recommendations: For IITB SSO version 1.1.0, reconfigure the settings to prevent unauthorized access ...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-45081

CVE-2025-45081 concerns IITB SSO v1.1.0, where misconfigured settings allow attackers to access sensitive application data. The available connected sources confirm the issue is tied to IITB SSO 1.1.0 and a configuration flaw rather than a code defect, with CVSS v3.1 base score 8.8 (HIGH) and an a...

CVE-2025-6701

A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-server/doLogin. The manipulation of the argument redirecturl leads to open redirect. The attack may be initiated remotely. The exploit has...

CVE-2025-20264

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to bypass the authorization mechanisms for specific administrative functions. This vulnerability is due to insufficient authorization enforcement mechanisms fo...