CVE-2023-32996

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32995

A cross-site request forgery CSRF vulnerability in Jenkins SAML Single Sign OnSSO Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails...

CVE-2023-32995

CVE-2023-32995 is a CSRF vulnerability in Jenkins SAML Single Sign On(SSO) Plugin versions 2.0.0 and earlier. The flaw allows an attacker with Overall/Read permission to trigger an HTTP POST with a JSON body to miniOrange’s API for sending emails due to a missing/unchecked permission check on an ...

CVE-2023-32994

Summary of CVE-2023-32994 : The Jenkins SAML Single Sign On (SSO) Plugin (versions ≤ 2.1.0) unconditionally disables SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to fetch SAML metadata. This vulnerability enables potential man-in-the-middle attacks on those m...

CVE-2023-32993

CVE-2023-32993 affects the Jenkins SAML Single Sign On (SSO) Plugin up to version 2.0.2. The root cause is missing hostname validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata, enabling MITM interception of those connections. Impact is limited to authenticatio...

CVE-2023-32992

CVE-2023-32992 affects Jenkins SAML Single Sign On (SSO) Plugin 2.0.2 and older. Several endpoints lack permission checks, enabling an attacker with Overall/Read to trigger HTTP requests to attacker-specified URLs and parse responses as XML or parse local files on the Jenkins controller as XML; t...

CVE-2023-32992

Missing permission checks in Jenkins SAML Single Sign OnSSO Plugin 2.0.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML...

CVE-2023-32991

CVE-2023-32991 affects Jenkins SAML Single Sign On (SSO) Plugin v2.0.2 and earlier. The issue is a CSRF vulnerability where attackers can cause the plugin to send HTTP requests to attacker-specified URLs or parse local Jenkins controller XML. Root causes include missing permission checks on multi...

PT-2023-24127 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SAML Single Sign OnSSO Plugin versions 2.0.0 and earlier Description: A missing permission check in the Jenkins SAML Single Sign OnSSO Plugin allows attackers with Overall/Read permission to send an HTTP POST request with a JSON body...

Jenkins Plugin SAML Single Sign On(SSO) 跨站请求伪造漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-9069 · Jenkins · Jenkins Saml Single Sign On(Sso) Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins SAML Single Sign OnSSO Plugin versions 2.0.2 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a loca...

Jenkins Plugin SAML Single Sign On(SSO) 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

CVE-2023-1965

An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...

Default credentials

An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...

CVE-2023-1965

Removed by vendor...

CVE-2023-1965

GitLab EE is affected: versions 14.2–15.9.5, 15.10–15.10.4, and 15.11–15.11.0 have a lack of verification on the RelayState parameter, allowing a maliciously crafted URL to obtain access tokens for 3rd party Group SAML SSO logins. This feature is not enabled by default. Impact described across mu...

CVE-2023-1965

An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...

CVE-2023-1965

An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access toke...

MAL-2023-634 Malicious code in nodebb-plugin-sso-auto-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3ab1b77199e67562a75d535a0d6c88f5d8d4c76b8df6d226e9528b0e050006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodebb-plugin-sso-auto-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3ab1b77199e67562a75d535a0d6c88f5d8d4c76b8df6d226e9528b0e050006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...