851 matches found
GHSA-5P5W-J3G7-W4WV Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Versions of saml2-js prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass. The saml2-js library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the...
Authentication Bypass
Overview Versions of samlify prior to 2.4.0 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the...
keycloak: session hijack using the user access token
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
CVE-2019-3868
Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...
CVE-2017-11428: Improper Authentication
OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...
CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...
Design/Logic Flaw
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...
CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...
CVE-2019-9628
The CVE-2019-9628 entry concerns the XMLTooling library (versions prior to V3.0.4) bundled with OpenSAML and Shibboleth SP. A parsing issue in the XML declaration causes an exception type that is not properly handled, propagating an unexpected exception. OpenSUSE/SUSE advisories explicitly link C...
CVE-2019-9628: Improper Handling of Exceptional Conditions
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...
CVE-2019-9628
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected...
CVE-2019-7383
An issue was discovered on Systrome Cumilon ISG-600C, ISG-600H, and ISG-800W devices with firmware V1.1-R2.1TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/ispupdateedit.php does not properly validate user input, which leads to...
Email service provider loses 2 decades worth of data due to hack attack
By Waqas Famed secure email service provider VFEmail has become a victim of a hack attack by an unknown cybercriminal. The company claims that it has suffered a “catastrophic destruction” of its US servers and almost two decades of data and backups in only a few hours. The entire digital...
Super-systemic IoT flaws
IoT security flaws were always systemic: by that I mean that if I find a flaw in my smart thermostat, it affects ALL of those thermostats. A security problem with one connected car leads to problems with ALL the connected cars using that same system. That led to incidents such as the Mirai botnet...
Cloud Connect replication fails with "The following hosts are incompatible with the target host"
Challenge An attempt to start or create a Cloud Connect replication job fails with the error message: " The following hosts are incompatible with the target host". Cause The following scenarios are known to cause the issue: 1. Tenant's Veeam installation had been updated to the latest version 9.5...
SAML Signature Wrapping
samlify is vulnerable to signature wrapping. An attacker is able wrap the signature of a SAML response and insert a new username in the original SAML token received from IdP before validating with the service provider. This allow the attacker to forge a token and impersonate as another user...
Accelerating PCI Data Security Standard projects with Deep Security as a Service
Does your organization need to meet PCI DSS requirements? Are you struggling with multiple security tools? Or stretching your already overstretched team to prepare for an audit? Time to hit the accelerator with Trend Micro! If your applications deal with credit or payment card data, you need to g...
Veeam Service Provider Console – Compile and Upload Server Logs
Purpose This article provides information about collecting Veeam Service Provider Console logs. Solution The log collection procedure for Veeam Service Provider Console is documented in the User Guide: Downloading Veeam Service Provider Console Logs Tip: Use the Archive button in the top-right of...
Veeam Service Provider Console – Compile and Upload Management Agent Logs
Challenge This article covers how to Management Agent logs for both client agents and the Cloud Connect agent. Solution Export Management Agent Logs To export Veeam Service Provider Console Management Agent logs for one or more client agents, please: 1. Log into the Veeam Service Provider Console...