2545 matches found
Malicious code in express-sso (npm)
The package express-sso was found to contain malicious code...
MAL-2025-20084 Malicious code in express-sso (npm)
The package express-sso was found to contain malicious code...
Malicious code in mean-sso (npm)
The package mean-sso was found to contain malicious code...
MAL-2025-33882 Malicious code in sso (npm)
The package sso was found to contain malicious code...
Malicious code in sso (npm)
The package sso was found to contain malicious code...
MAL-2025-33883 Malicious code in sso-paypal (npm)
The package sso-paypal was found to contain malicious code...
MAL-2025-26121 Malicious code in mean-sso (npm)
The package mean-sso was found to contain malicious code...
CVE-2025-40758: Improper Verification of Cryptographic Signature
A vulnerability has been identified in Mendix SAML Mendix 10.12 compatible All versions V4.0.3, Mendix SAML Mendix 10.21 compatible All versions V4.1.2, Mendix SAML Mendix 9.24 compatible All versions V3.6.21. Affected versions of the module insufficiently enforce signature validation and binding...
CVE-2025-49264: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On...
CVE-2025-34142
CVE-2025-34142 : ETQ Reliance on the CG (legacy) platform is affected via the /resources/sessions/sso endpoint. The SAML handler processes XML without disabling external entity resolution, enabling XXE that could disclose sensitive files or enable SSRF. Remediation in the reports specifies disabl...
CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler
An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...
CVE-2025-34142 ETQ Reliance CG < SE.2025.1 / < 2025.1.2 XXE Injection in SSO SAML Handler
An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...
CVE-2025-34142: Improper Restriction of XML External Entity Reference
An XML External Entity XXE injection vulnerability exists in ETQ Reliance on the CG legacy platform within the /resources/sessions/sso endpoint. The SAML authentication handler processes XML input without disabling external entity resolution, allowing crafted SAML responses to invoke external...
CVE-2025-34063
A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...
CVE-2025-45081
Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...
CVE-2025-45081
Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...
CVE-2025-34063
A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...
CVE-2025-34063 OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key
A cryptographic authentication bypass vulnerability exists in OneLogin AD Connector prior to 6.1.5 due to the exposure of a tenant’s SSO JWT signing key via the /api/adc/v4/configuration endpoint. An attacker in possession of the signing key can craft valid JWT tokens impersonating arbitrary user...
CVE-2025-34062 OneLogin AD Connector API Credential and Signing Key Exposure
An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint. An attacker with access to a valid directorytoken—which may be retrievable from host registry keys or improperly secured logs—can retrieve a plaintext respon...