CVE-2014-0034

CVE-2014-0034 affects Apache CXF: the SecurityTokenService (STS) does not properly validate SAML tokens when caching is enabled, enabling a remote attacker to gain access with an invalid SAML token. Affected: CXF before 2.6.12 and 2.7.x before 2.7.9. Root cause: inadequate validation of SAML toke...

CVE-2014-0034: Improper Input Validation

The SecurityTokenService STS in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security...

PT-2014-3442

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 2.6.12 Apache CXF versions 2.7.x prior to 2.7.9 Description The issue is related to the SecurityTokenService STS in Apache CXF, which does not properly validate SAML tokens when caching is enabled. This allows remo...

Xxe

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-6440

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-6440

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-6440: Exposure of Sensitive Information to an Unauthorized Actor

The 1 BasicParserPool, 2 StaticBasicParserPool, 3 XML Decrypter, and 4 SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity XXE attacks via a crafted XML DOCTYPE declaration...

CVE-2013-0582

Cross-site scripting XSS vulnerability in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject...

CVE-2013-0582

Cross-site scripting XSS vulnerability in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject...

CVE-2013-0582: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject...

CA SiteMinder privilege escalation

Invalid SAML signature verification...

CA20130319-01: Security Notice for SiteMinder products using SAML

-----BEGIN PGP SIGNED MESSAGE----- CA20130319-01: Security Notice for SiteMinder products using SAML Issued: March 19, 2013 CA Technologies support is alerting customers to a potential risk with certain CA SiteMinder products that implement Security Assertion Markup Language SAML. Multiple...

CVE-2013-2279

CA SiteMinder Federation FSS 12.5, 12.0, and r6; Federation Standalone 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain...

Code injection

CA SiteMinder Federation FSS 12.5, 12.0, and r6; Federation Standalone 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain...

CVE-2013-2279

The CVE-2013-2279 issue affects CA SiteMinder Federation (FSS) 12.5/12.0 and r6, Federation Standalone 12.1/12.0, Agent for SharePoint 2010, and SiteMinder for Secure Proxy Server (6.0/12.0/12.5). Root cause: inadequate verification of XML signatures in SAML statements, enabling remote attackers ...

CVE-2013-2279

CA SiteMinder Federation FSS 12.5, 12.0, and r6; Federation Standalone 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain...