PT-2017-10349

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 1.14.10 simplesamlphp/saml2 library versions prior to 1.9.1 simplesamlphp/saml2 library 1.10.x versions prior to 1.10.3 simplesamlphp/saml2 library 2.x versions prior to 2.3.3 Description The issue allows remote...

How to configure SAML Authentication using Metadata?

To configure SAML Authentication with StoreFront you can use the metadata support option. This article describes the steps to perform the metadata based configuration...

How to Configure SAML- Introduction?

SAML is an XML-based open standard which enables authentication of users across products or organizations. SAML is used by identity providers such as Google and by identity and authentication products such as Microsoft AD FS, Ping Identity, CA SiteMinder and more. Citrix customers wish to use...

DEBIAN-CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

UBUNTU-CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

Design/Logic Flaw

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

CVE-2016-5697

CVE-2016-5697 concerns the Ruby-saml library before version 1.3.0, where improper handling of SAML signatures allows XML signature wrapping attacks via unspecified vectors. The vulnerability can enable an unauthenticated attacker to impersonate a user by abusing how SAML responses are validated (...

CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

CVE-2016-5697

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

PT-2017-8747 · Ruby +2 · Ruby-Saml +2

Name of the Vulnerable Software and Affected Versions: ruby-saml versions prior to 1.3.0 Description: The issue allows attackers to perform XML signature wrapping attacks. This occurs in a specific scenario where a signature references two elements simultaneously, one of which is inside an...

CVE-2016-5697: XML Injection (aka Blind XPath Injection)

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...

PT-2017-7752

Name of the Vulnerable Software and Affected Versions PySAML2 affected versions not specified Description The issue allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response. Recommendations At the moment, there is no information about a newer...

CVE-2016-10127

PySAML2 allows remote attackers to conduct XML external entity XXE attacks via a crafted SAML XML request or response...

ForgeRock OpenAM - Access Management XML External Entity Injection Vulnerability

ForgeRock OpenAM - Access Management is the United States ForgeRock company's set of open source single sign-on framework SSO, which provides a core identity services Core Server to achieve a transparent single sign-on in a network architecture such as centralized, distributed single sign-on. An...

CVE-2016-10097

XML External Entity XXE Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter...

Code injection

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...

CVE-2016-6659

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release aka uaa-release before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially craft...