VMware Workspace ONE Unified Endpoint Management Console (AirWatch Console) update resolves SAML authentication bypass vulnerability

The VMware Workspace ONE Unified Endpoint Management Console AirWatch Console contains a SAML authentication bypass vulnerability which can be leveraged during device enrollment. This vulnerability may allow for a malicious actor to impersonate an authorized SAML session if certificate-based...

CVE-2018-1793

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Cross site scripting

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1793

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1793

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1793

CVE-2018-1793 is an IBM WebSphere Application Server Cross-site scripting issue in the SAML ear component that could allow an attacker to inject JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. The connected IBM bulletins confirm the vulnerabilit...

Security Bulletin: Multiple security vulnerabilities affect IBM WebSphere Application Server in IBM Cloud (CVE-2018-1614, CVE-2018-1621)

Summary There is a potential Information disclosure vulnerability in WebSphere Application Server using SAML. There is a potential Information disclosure vulnerability in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1614 DESCRIPTION: IBM WebSphere Application Server using...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 6.4.21 (RHSA-2018:2741)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2741 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of Picketlink replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID fie...

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of Picketlink replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID fie...

Errors using SecurAuth SAML to StoreFront Site

The customer is setting up a new SAML store to use SecurAuth in place of smart cards for certain MAC users due to a known compatibility of Smart Cards with MAC devices When navigating to the URL portal, we are returned with the following error after entering the PIN and being redirected to a seco...

Code injection

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

CVE-2018-5549

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

CVE-2018-5549

On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elements...

CVE-2018-5549

CVE-2018-5549 affects BIG-IP APM SAML IdP (APMD may core) when processing SAML Assertions/responses. Affected: BIG-IP APM 11.6.0–11.6.3.1, 12.1.0–12.1.3.3, 13.0.0, 13.1.0–13.1.0.3. Impact: disruption of service (potential crash). Remediation: upgrade to fixed releases per vendor advisory (13.1.0....

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WAS Liberty vulnerability

Summary Rational Asset Analyzer RAA has addressed the following vulnerability: IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions by the SAML Web SSO feature. Vulnerability Details CVEID: CVE-2018-1553...

fedhub.covisint.com XSS vulnerability

Open Bug Bounty ID: OBB-673900 Description| Value ---|--- Affected Website:| fedhub.covisint.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Unable to start application with SAML authentication "Cannot Start App" Event ID 28 Could not contact any Federated Authentication Servers

Launching an application or desktop fails when StoreFront is configured for FAS/SAML authentication. Error seen when user tries to launch an application or desktop: No errors are logged on the FAS server. Storefront will show event ID 28 with error showing "...Could not contact any Federated...

GHSA-36P7-XJW8-H6F2 Ruby-saml allows attackers to perform XML signature wrapping attacks

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements but past the scheme validator process since 1 of the element was inside the encrypted assertion. ruby-saml users must...

Ruby-saml allows attackers to perform XML signature wrapping attacks

ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements but past the scheme validator process since 1 of the element was inside the encrypted assertion. ruby-saml users must...