1709 matches found
BIT-ARTIFACTORY-2023-42662
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration...
Jira redirects the users back to the login page when SSO is used with Crowd
h3. Issue Summary Jira redirects the users back to the login page when SSO is used with Crowd when SSOSeraphAuthenticator is enabled in the seraph-config.xml. It works fine when Crowd is not used when JiraSeraphAuthenticator is enabled. This is reproducible on Data Center: Yes h3. Steps to...
CVE-2023-42662
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration...
Input validation
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration...
CVE-2023-42662
CVE-2023-42662 (JFrog Artifactory) affects Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, and 7.71.8. The issue arises from improper handling of the CLI/IDE browser-based SSO integration, allowing user interaction with specially crafted URLs to expose user access tokens...
CVE-2023-42662 JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration...
CVE-2023-42662 JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens
JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereby user interaction with specially crafted URLs could lead to exposure of user access tokens due to improper handling of the CLI / IDE browser based SSO integration...
BIT-GITLAB-2022-1680
An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature available only on Premium+...
BIT-GITLAB-2022-4331
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible...
BIT-GITLAB-2023-1965
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...
BIT-MOODLE-2023-35132 Moodle: minor sql injection risk on mnet sso access control page
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions...
BIT-ARGO-CD-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
CVE-2024-0560 Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
A vulnerability was found in 3Scale, when used with Keycloak 15 or RHSSO 7.5.0 and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO...
Red Hat 3scale Security Vulnerability
Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A security vulnerability exists in Red Hat 3Scale that stems from an incompatibility between the use3scaleoidcissuerendpoint of the token introspection policy and RH-SSO 7.5 or later...
PT-2024-2635 · Red Hat · 3Scale +2
Name of the Vulnerable Software and Affected Versions: 3Scale versions used with Keycloak 15 or RHSSO 7.5.0 Description: The issue is related to incorrect handling of insufficient permissions or privileges in the 3Scale API Management software. When the auth type is set to use 3scale oidc issuer...
Login form doesn't get disabled when option is disabled from authentication methods
h3. Issue Summary When we remove the option to authenticate with username and password from the login form we could still use basic authentication to login. This is reproducible on Data Center: Yes h3. Steps to Reproduce Step-1. Remove the option to authenticate with username and password from th...
ITFlow Cross Site Request Forgery
CVE: CVE-2024-25344 CWE: CWE-352 Vendor: ITFlow.org Affected product: ITFlow - Before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 Discoverer: stehled, WP-Pomoc.cz Attack-Type: Remote AV: Admin user has to open a page, provided by an attacker, which will then perform malicious request changing...
CVE-2024-20915
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Login - SSO. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application...
CVE-2024-20915
CVE-2024-20915 affects Oracle E-Business Suite’s Oracle Application Object Library (AOL), Login - SSO component. Affected: AOL in E-Business Suite versions 12.2.3–12.2.13. Issue: insufficient input validation in the Login - SSO path allows an unauthenticated, network-accessible attacker (via HTTP...