CVE-2017-18122: Improper Verification of Cryptographic Signature

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid...

Your service provider has implemented backup files protection against deletion by an insider for this cloud repository.

Intended Audience Keep in mind that the structure and message of this article are written assuming the reader is a Veeam Cloud Service Provider. Challenge A tenant's backup copy job with GFS disabled displays the following warning when targeting a Cloud Repository provided by a Veeam Cloud Servic...

Shibboleth for Windows Shibboleth Service Provider Shibboleth XMLTooling-C Information Disclosure Vulnerability

Shibboleth for Windows is an open source SAML based Web Single Sign-On system for Windows from Shibboleth, UK. Shibboleth Service Provider SP is one of the Service Provider components. Shibboleth Service Provider SP is one of the service provider component . Shibboleth XMLTooling-C is one of the...

DEBIAN-CVE-2018-0486

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD...

CVE-2018-0486: Improper Verification of Cryptographic Signature

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD...

Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

GHSA-8JJF-W7J6-323C Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

“Ready Player One” – Are you Ready to Protect Your Endpoints from the Bad Guys?

At times it can feel like a game as you watch the cyber-breach scorecards. Yahoo 3 billion users, Equifax 143 million consumers, Uber 57 million users, Imgur 1.7 million users are just a sample of the companies that have released new information on large breaches in the last few months...

How to deploy Veeam Service Provider Console Communication Agent in Unattended Mode

Challenge Some deployment scenarios may require that the Veeam Service Provider Console Communication Agent is deployed via Windows PowerShell in the silent mode. Solution Run Windows PowerShell as administrator and execute following command with correct values for Tenant's username in VACTENANT=...

FS Gigs Script SQL Injection Vulnerability

FS Gigs Script is an online free market creation software based on PHP and MySQL. A SQL injection vulnerability exists in FS Gigs Script version 1.0. A remote attacker can inject SQL commands by sending the 'sc' parameter to the browse-category.php file or the 'ser' parameter to the...

Sql injection

FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter...

CVE-2017-17576

FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter...

FS Gigs Script 1.0 - 'cat' / 'sc' SQL Injection

Exploit Title: FS Gigs Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/gigs-script/ Demo: http://gigs.demonstration.co.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

VulnCheck KEV: CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

How to Change Veeam Service Provider Console Website Port

Purpose This article documents how to change the port used by the Veeam Service Provider Console Portal. Solution Note: The Veeam Service Provider Console software was previously known as Veeam Availability Console. The old name is still used in some locations for backward compatibility, in...

CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity...

CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity...

UBUNTU-CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity...

CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity...

CVE-2017-16852

CVE-2017-16852 affects Shibboleth Service Provider (shibboleth-sp) via the Dynamic MetadataProvider plugin. In versions before 2.6.1, it may misconfigure with MetadataFilter plugins and skip critical checks such as signature verification and validity period enforcement, among other deployment-spe...