Microsoft Windows WCF/WIF SAML Token CVE-2019-1006 Authentication Bypass Vulnerability

Description Microsoft Windows is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication mechanism and gain unauthorized access. This may lead to further attacks. Technologies Affected Microsoft .NET Framework 2.0 SP2 Microsoft .NET Framewo...

PT-2019-2678

Name of the Vulnerable Software and Affected Versions Windows Communication Foundation WCF and Windows Identity Foundation WIF affected versions not specified Description An authentication bypass issue exists, allowing the signing of SAML tokens with arbitrary symmetric keys. This can enable an...

OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

GHSA-94HM-8Q65-RMXM OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

Ruby-SAML Improper Authentication vulnerability

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

GHSA-X2FR-V8WF-8WWV Ruby-SAML Improper Authentication vulnerability

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

Python-saml allows manipulation of SAML data without invalidation of cryptographic signature

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

GHSA-J8J8-348V-WFM3 Python-saml allows manipulation of SAML data without invalidation of cryptographic signature

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authenticatio...

Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js

Versions of saml2-js prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass. The saml2-js library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the...

wicked-saml (>=0.10.0, <=0.11.3) potentially affected by CVE-2017-11429 via saml2-js (1.10.0)

saml2-js NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on saml2-js and may be impacted: - wicked-saml =0.10.0, =0.11.3 Source cves: CVE-2017-11429 Source advisory: OSV:GHSA-5P5W-J3G7-W4WV...

GHSA-5P5W-J3G7-W4WV Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js

Versions of saml2-js prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass. The saml2-js library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the...

WordPress SAML SP Single Sign On plugin <= 4.8.72 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by ZEROAUTH in WordPress SAML SP Single Sign On plugin versions = 4.8.72. Solution Update the WordPress SAML SP Single Sign On plugin to the latest available version at least 4.8.73...

WordPress miniOrange SAML SP Single Sign On Plugin <= 4.8.72 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112436";...

CVE-2019-12346

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post...

CVE-2019-12346

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post...

Code injection

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post...

CVE-2019-12346

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post...

CVE-2019-12346

The CVE-2019-12346 case concerns the WordPress plugin miniOrange SAML SP Single Sign On. Multiple sources confirm a cross-site scripting (XSS) vulnerability in the SAML Login Endpoint when processing a crafted SAMLResponse XML POST, affecting plugin versions prior to 4.8.73. The issue is document...

PT-2019-12760

Name of the Vulnerable Software and Affected Versions miniOrange SAML SP Single Sign On plugin versions prior to 4.8.73 Description The issue concerns a vulnerability in the SAML Login Endpoint, which is susceptible to XSS attacks via a specially crafted SAMLResponse XML post. Recommendations For...

CVE-2019-12346: Improper Neutralization of Input During Web Page Generation

In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post...