1721 matches found
BIT-GITLAB-2022-4331
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible...
BIT-GITLAB-2023-1965
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...
BIT-MOODLE-2023-35132 Moodle: minor sql injection risk on mnet sso access control page
A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions...
BIT-ARGO-CD-2021-23347
The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...
CVE-2024-0560 Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
A vulnerability was found in 3Scale, when used with Keycloak 15 or RHSSO 7.5.0 and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO...
Red Hat 3scale Security Vulnerability
Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A security vulnerability exists in Red Hat 3Scale that stems from an incompatibility between the use3scaleoidcissuerendpoint of the token introspection policy and RH-SSO 7.5 or later...
PT-2024-2635 · Red Hat · 3Scale +2
Name of the Vulnerable Software and Affected Versions: 3Scale versions used with Keycloak 15 or RHSSO 7.5.0 Description: The issue is related to incorrect handling of insufficient permissions or privileges in the 3Scale API Management software. When the auth type is set to use 3scale oidc issuer...
Login form doesn't get disabled when option is disabled from authentication methods
h3. Issue Summary When we remove the option to authenticate with username and password from the login form we could still use basic authentication to login. This is reproducible on Data Center: Yes h3. Steps to Reproduce Step-1. Remove the option to authenticate with username and password from th...
ITFlow Cross Site Request Forgery
CVE: CVE-2024-25344 CWE: CWE-352 Vendor: ITFlow.org Affected product: ITFlow - Before commit 432488eca3998c5be6b6b9e8f8ba01f54bc12378 Discoverer: stehled, WP-Pomoc.cz Attack-Type: Remote AV: Admin user has to open a page, provided by an attacker, which will then perform malicious request changing...
CVE-2024-20915
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Login - SSO. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application...
CVE-2024-20915
CVE-2024-20915 affects Oracle E-Business Suite’s Oracle Application Object Library (AOL), Login - SSO component. Affected: AOL in E-Business Suite versions 12.2.3–12.2.13. Issue: insufficient input validation in the Login - SSO path allows an unauthenticated, network-accessible attacker (via HTTP...
CVE-2024-21401 Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
...
DEBIAN-CVE-2024-25715
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
CVE-2024-25715
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
CVE-2024-25715
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
Open redirect
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
CVE-2024-25715
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
CVE-2024-25715
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirecturi...
Glewlwyd SSO server input validation error vulnerability
The Glewlwyd SSO server is a single sign-on SSO server for multi-factor authentication for OAuth2 and OpenID Connect authentication. An input validation error vulnerability exists in Glewlwyd SSO server versions 2.x through 2.7.6, which stems from an open redirection vulnerability in the componen...
