PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

A flaw was found in the way PicketLink's Service Provider SP and Identity Provider IdP handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was...

PicketLink: SP does not take Audience condition of a SAML assertion into account

A flaw was found in the way PicketLink's Service Provider and Identity Provider handled certain requests. A remote attacker could use this flaw to log to a victim's account via PicketLink...

PicketLink: SP does not take Audience condition of a SAML assertion into account

A flaw was found in the way PicketLink's Service Provider and Identity Provider handled certain requests. A remote attacker could use this flaw to log to a victim's account via PicketLink...

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

A flaw was found in the way PicketLink's Service Provider SP and Identity Provider IdP handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was...

MGASA-2015-0148 Updated shibboleth-sp packages fix CVE-2015-2684

Updated shibboleth-sp package fixes security vulnerability: A denial of service vulnerability was found in the Shibboleth Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash CVE-2015-2684...

Updated shibboleth-sp packages fix CVE-2015-2684

Updated shibboleth-sp package fixes security vulnerability: A denial of service vulnerability was found in the Shibboleth Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash CVE-2015-2684...

[BSA-103] Security Update for shibboleth-sp

Matthew Vernon uploaded new packages for shibboleth-sp which fixed the following security problems: CVE-2015-2684 A denial of service vulnerability was found in the Shibboleth a federated identity framework Service Provider. When processing certain malformed SAML messages generated by an...

Shibboleth Service Provider Denial of Service Vulnerability

Shibboleth is the British Shibboleth Group of a set of open source based on the SAML protocol of the Web single sign-on system . Shibboleth Service Provider SP is one of the service provider . A security vulnerability exists in Shibboleth SP versions prior to 2.5.4. The vulnerability can be...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

Code injection

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

UBUNTU-CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

CVE-2015-2684 affects the Shibboleth Service Provider (SP) prior to version 2.5.4. It allows a remote authenticated attacker to cause a denial of service (crash) by sending crafted SAML messages; multiple sources confirm a fix involves upgrading/shifting to newer SP releases (e.g., 2.5.4+ and rel...

CVE-2015-2684: Improper Input Validation

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

[SECURITY] [DSA 3207-1] shibboleth-sp2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3207-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez March 28, 2015 http://www.debian.org/security/faq -...

PT-2015-5836

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider SP versions prior to 2.5.4 Description The issue allows remote authenticated users to cause a denial of service, resulting in a crash, by sending a crafted SAML message. Recommendations For versions prior to 2.5.4,...

Optimizing encrypted video

Security Optimizing encrypted video Share February 25th, 2015 You might have seen our press release that Opera’s Rocket Optimizer can now optimize encrypted video streams. The attentive reader will already have halted and said, “wait, what?”. In this blog post, we’ll explain how this works. Rocke...

ManageEngine Desktop Central MSP Remote Code Execution Vulnerability

Manageengine desktop central is a complete windows client management software that enables remote management of desktop and mobile computers with its remote software installation and configuration options. A remote code execution vulnerability exists in ManageEngine Desktop Central MSP, which can...