com.agifac.lib:app-framework (>=12.1.0, <=16.0.4), com.agifac.lib:maf-defaultplugins-extension (>=12.1.1, <=16.0.4) +281 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=1.5.1, <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =1.5.1, =12.1.0, =12.1.1, =12.1.2, =12.1.0, =12.1.4, =1.0, =1.0, =1.9.0, =2.0.1, =16.1.0, =16.1.0, =16.1.0, =16.1.0, =16.1.0, =0.8.0, =1.1.0 and more Source cves: CVE-2019-10755 Source advisory: MEND:CVE-2019-10755...

Improper Verification of Cryptographic Signature in keycloak

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...

GHSA-4FGQ-GQ9G-3RW7 Improper Verification of Cryptographic Signature in keycloak

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...

PT-2019-12029

Name of the Vulnerable Software and Affected Versions pac4j-saml versions 3.X Description The issue arises from the use of the apache commons-lang3 RandomStringUtils class in SAML2Utils.java to generate SAML identifiers. This class uses a pseudorandom number generator PRNG algorithm that is not...

CVE-2019-10755: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.3.1, <=5.3.3) +232 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=3.0.0-rc2, <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =3.0.0-rc2, =5.3.1, =5.3.1, =5.3.1, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.3 and more Source cves: CVE-2019-10755 Source advisory: SNYK:JAVA-ORGPAC4J-467407...

XML External Entities (XXE)

saml-client is vulnerable to XML external entities XXE. The vulnerability exists as DISALLOWDOCTYPEDECLFEATURE was not enabled when creating the DOMParser object...

WordPress onelogin-saml-sso plugin trust management issue vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. onelogin-saml-sso is an authentication plugin used in it. The WordPress onelogin-saml-sso plugin is vulnerable to a trust management...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

Hardcoded credentials

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

CVE-2016-10928

The CVE-2016-10928 entry affects the WordPress Onelogin SAML SSO plugin (pre-2.2.0). The flaw is a hardcoded @@@nopass@@@ password used for just-in-time provisioned users, exposing an authentication weakness in affected deployments. Connected sources corroborate the issue across Red Hat, NVD/NVD-...

PT-2019-7724

Name of the Vulnerable Software and Affected Versions onelogin-saml-sso plugin versions prior to 2.2.0 Description The issue concerns a hardcoded password @@@nopass@@@ used for just-in-time provisioned users. Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve...

CVE-2016-10928: Use of Hard-coded Credentials

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users...

Cisco Adaptive Security Appliance VPN SAML Authentication Bypass Vulnerability (cisco-sa-20190501-asaftd-saml-vpn)

According to its self-reported version the Cisco Adaptive Security Appliance ASA software running on the remote device is affected by an authentication bypass vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and...

Cisco Firepower Threat Defense (FTD) VPN SAML Authentication Bypass Vulnerability (cisco-sa-20190501-asaftd-saml-vpn)

According to its self-reported version, the Cisco Firepower Threat Defense FTD Software is affected by an authentication bypass vulnerability in the implementation of Security Assertion Markup Language SAML 2.0 Single Sign-On SSO for Clientless SSL VPN WebVPN and AnyConnect Remote Access VPN. The...

CVE-2019-10201

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...

CVE-2019-10201

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...