3944 matches found
Debian DSA-4926-1 : lasso - security update
It was discovered that lasso, a library which implements SAML 2.0 and Liberty Alliance standards, did not properly verify that all assertions in a SAML response were properly signed, allowing an attacker to impersonate users or bypass access control. %NASLMINLEVEL 70300 C Tenable Network Security...
Debian: Security Advisory (DSA-4926-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
DEBIAN-CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
Authentication flaw
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
CVE-2021-33054
SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. Only versions after 2.0.5a are affected...
CVE-2021-33054
CVE-2021-33054 affects SOGo 2.x (before 2.4.1) and 3.x–5.x (before 5.1.1); the issue is that SOGo does not validate signatures of any SAML assertions, allowing an attacker with network access to impersonate users via SAML authentication. The root cause is the lack of SAML signature validation. Pu...
SOGo 数据伪造问题漏洞
SOGo is a very fast and scalable modern collaboration suite. It provides calendaring, address book management and a full-featured Webmail client, as well as resource sharing and permission handling. A security vulnerability exists in SOGo that stems from the fact that when the program's SAML is t...
Aviatrix Systems Unspecified Vulnerability in Aviatrix VPN Client
Aviatrix Systems Aviatrix VPN Client is a VPN Virtual Private Network client application that provides SAML authentication from Aviatrix Systems, USA. A security vulnerability exists in Aviatrix VPN Client versions prior to 2.14.14, which can be exploited by an attacker to allow escalation of loc...
PT-2021-4286
Name of the Vulnerable Software and Affected Versions SOGo versions 2.0.5a through 2.4.1 SOGo versions 3.x through 5.x before 5.1.1 Description The issue is related to the incorrect validation of cryptographic signatures in SAML assertions, which could allow a remote attacker to impersonate users...
[SECURITY] [DSA 4926-1] lasso security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4926-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2021 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4926-1] lasso security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4926-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 03, 2021 https://www.debian.org/security/faq -...
Ubuntu: Security Advisory (USN-4974-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-4974-1: Lasso vulnerability
It was discovered that Lasso did not properly verify that all assertions in a SAML response were properly signed. An attacker could possibly use this to impersonate users or otherwise bypass access controls...
CVE-2021-22123
An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page...
CVE-2021-22123
An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page...
Command injection
An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page...