SUSE CVE-2017-16852

shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity...

SUSE CVE-2018-0486

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD...

SUSE CVE-2019-19191

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

SUSE CVE-2021-31826

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable for a daemon crash on systems not using this feature if a crafted cookie is supplied...

SUSE CVE-2022-2119

OFFIS DCMTK's All versions prior to 3.6.7 service class provider SCP is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution...

Sydney Man Sentenced for Blackmailing Optus Customers After Data Breach

A Sydney man has been sentenced to an 18-month Community Correction Order CCO and 100 hours of community service for attempting to take advantage of the Optus data breach last year to blackmail its customers. The unnamed individual, 19 when arrested in October 2022 and now 20, used the leaked...

New BOLDMOVE Backdoor uses FortiOS vulnerability for initial access

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A suspected China-nexus campaign has exploited a vulnerability in Fortinets FortiOS SSL-VPN, known as CVE-2022-42475. The exploitation was believed to have occurred as early as October 2022 and the targe...

Command Execution Vulnerability in Damon Database Management System (DM8) Kirin Version

Wuhan Damon Database Co., Ltd. is a database product development service provider. A command execution vulnerability exists in Damon Database Management System DM8 Kirin Edition, which can be exploited by attackers to execute arbitrary commands...

CVE-2023-22405 Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot

An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service DoS to device due to out of resources. When a device...

CVE-2023-22405

CVE-2023-22405 describes a DoS in Juniper Networks Junos OS caused by an improper preservation of consistency between independent representations of shared state in the Packet Forwarding Engine (PFE). When devices run with service-provider/SP style switching and MAC limiting on an Aggregated Ethe...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

Shibboleth 代码问题漏洞

Shibboleth is an open source SAML protocol Web Single Sign-On system for Windows from Shibboleth, UK. A security vulnerability exists in Shibboleth Service Provider SP Windows versions prior to 3.4.1, which stems from the installation being located under C:opt instead of C:Program Files by defaul...

PT-2023-18789 · Unknown · Shibboleth Service Provider

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider SP versions prior to 3.4.1 Description: The issue concerns insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP. This allows an unprivileged local attacker to escalate...

PT-2023-10099 · Unknown · Ttskch Paginationserviceprovider

Name of the Vulnerable Software and Affected Versions: ttskch PaginationServiceProvider versions up to 0.x Description: A critical vulnerability was found in the ttskch PaginationServiceProvider. The issue affects the file demo/index.php of the component demo. The manipulation of the sort/id...

CVE-2022-32638

In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07494449; Issue ID: ALPS07494449...

SimpleSAMLphp 跨站脚本漏洞

SimpleSAMLphp is a PHP authentication application that implements SAML 2.0 service provider and identity provider functionality. A cross-site scripting vulnerability exists in SimpleSAMLphp that stems from cross-site scripting due to misuse of the parameter AuthState...

What To Look For In The Best WordPress Hosting

By Owais Sultan Choosing the right hosting service provider is one of the most critical yet often overlooked components when it… This is a post from HackRead.com Read the original post: What To Look For In The Best WordPress Hosting...