CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

Authentication flaw

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2018-5387

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

CVE-2018-5387: Improper Authentication

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service...

PT-2018-16940

Name of the Vulnerable Software and Affected Versions Wizkunde SAMLBase affected versions not specified Description The issue arises from the incorrect utilization of XML DOM traversal and canonicalization APIs, which may allow an attacker to manipulate SAML data without invalidating its...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli Security Policy Manager (CVE-2018-1614)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Tivoli Security Policy Manager TSPM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security...

Oracle Fusion Middleware 12c (12.2.1.3.0) WebLogic SAML Issues Vulnerability

Two vulnerabilities were discovered within the Oracle WebLogic SAML service provider authentication mechanism. By inserting an XML comment into the SAML NameID tag, an attacker can coerce the SAML service provider to log in as another user. Additionally, WebLogic does not require signed SAML...

Oracle Fusion Middleware 12c (12.2.1.3.0) WebLogic SAML Issues

Oracle WebLogic - Multiple SAML Vulnerabilities CVE-2018-2998/CVE-2018-2933 Release URL: https://pulsesecurity.co.nz/advisories/WebLogic-SAML-Vulnerabilities Date Released: 18/07/2018 CVE: CVE-2018-2998 CVE-2018-2933 Author: Denis Andzakovic Vendor Website: http://www.oracle.com Affected Software...

Oracle WebLogic Server Multiple Vulnerabilities (July 2018 CPU)

The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability in the Spring Framework Sample Apps subcomponent in Oracle WebLogic allows an unauthenticated, remote attacker to takeover a WebLogic server. CVE-2018-1275 - ...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager(CVE-2018-1614).

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Security Identity Manager ISIM. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Please consult the security bulletin...

Oracle Fusion Middleware Oracle WebLogic Server Component Remote Vulnerability

Oracle Fusion Middleware Oracle Fusion Middleware is a set of business innovation platform for enterprise and cloud environments from Oracle. The platform provides middleware, software collection, etc. Oracle WebLogic Server is one of the application server components for cloud and traditional...

CVE-2018-2998

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: SAML. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2018-2998

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: SAML. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

Design/Logic Flaw

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: SAML. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2018-2998

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: SAML. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2018-2998

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: SAML. Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac...

CVE-2018-2998

CVE-2018-2998 affects Oracle WebLogic Server (SAML subcomponent) in Oracle Fusion Middleware. Affects supported versions: 10.3.6.0, 12.1.3.0, 12.2.1.2, 12.2.1.3. An attacker with network access over HTTP and low privileges can potentially perform unauthorized updates/inserts/deletes and read acce...

Security Bulletin: Security vulnerabilities have been identified in the WebSphere Application Server where the RAM is deployed.

Summary In the WebSphere Application Server where the Rational Asset Manager is deployed, a remote attacker could exploit the vulnerabilities such as spoofing attacks, execute arbitrary codes, exploit sensitive information and so on. Information about these security vulnerabilities affecting...

Authentication Bypass

SimpleSAMLphp is vulnerable to authentication bypasses. A malicious user can pass an unsigned SAML response with multiple assertions to the application. As long as one of the assertions are valid the application will consider the SAML response valid and grant access to the malicious user...