5209 matches found
Authentication flaw
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...
CVE-2020-5425 User Impersonation possible in Tanzu SSO
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...
PT-2020-18476
Name of the Vulnerable Software and Affected Versions Single Sign-On for Vmware Tanzu versions prior to 1.11.3 Single Sign-On for Vmware Tanzu versions 1.12.x prior to 1.12.4 Single Sign-On for Vmware Tanzu versions 1.13.x prior to 1.13.1 Description The issue allows for a user impersonation...
CVE-2020-5425: Improper Authentication
Single Sign-On for Vmware Tanzu all versions prior to 1.11.3 ,1.12.x versions prior to 1.12.4 and 1.13.x prior to 1.13.1 are vulnerable to user impersonation attack.If two users are logged in to the SSO operator dashboard at the same time, with the same username, from two different identity...
Security Bulletin: A Security Vulnerability Has Been Identified In IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2020-4782)
Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...
Privilege Escalation
Satellite is vulnerable to privilege escalation. An attacker with an authenticated account on Single sign-on SSO is able to gain elevated privileges of existing local users...
Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover
Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on SSO to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to...
Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover
Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on SSO to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to...
jenkins-credentials-binding-plugin: improper masking of secrets
Jenkins Credentials Binding Plugin 1.22 and earlier does not mask i.e., replace with asterisks secrets containing a $ character in some circumstances...
Cross-Site Scripting (XSS)
matrixsynapse is vulnerable to cross-site scripting XSS. A attacker is able to inject and execute arbitrary Javascript in a user's browser via the reCAPTCHA, consent terms of service, or single sign-on functions...
Cross site scripting
Multiple stored cross-site scripting XSS vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of the less-than sign...
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Impact The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting XSS attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other...
CVE-2020-7591
A vulnerability has been identified in SIPORT MP All versions 3.2.1. Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform potentially administrative actions on behalf of those users if the single sign-on feature "Allow logon...
Design/Logic Flaw
A vulnerability has been identified in SIPORT MP All versions 3.2.1. Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform potentially administrative actions on behalf of those users if the single sign-on feature "Allow logon...
CVE-2020-7591
A vulnerability has been identified in SIPORT MP All versions 3.2.1. Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform potentially administrative actions on behalf of those users if the single sign-on feature "Allow logon...
CVE-2020-7591
CVE-2020-7591 affects SIPORT MP (all versions prior to 3.2.1). The flaw is described as Use of client-side authentication (CWE-603), enabling an authenticated attacker to impersonate other users and perform (potentially administrative) actions on behalf of those users if the single sign-on featur...
PT-2020-19640
Name of the Vulnerable Software and Affected Versions SIPORT MP versions prior to 3.2.1 Description A vulnerability has been identified that could allow an authenticated attacker to impersonate other users of the system and perform actions on their behalf if the single sign-on feature "Allow logo...
CVE-2020-7591: Use of Client-Side Authentication
A vulnerability has been identified in SIPORT MP All versions 3.2.1. Vulnerable versions of the device could allow an authenticated attacker to impersonate other users of the system and perform potentially administrative actions on behalf of those users if the single sign-on feature "Allow logon...
Drupal OAuth Server ( OAuth / OIDC Provider) - Single Sign On ( SSO ) - Moderately critical - SQL Injection - SA-CONTRIB-2020-034
This module enables you login into any OAuth 2.0 compliant application using Drupal credentials. The 8.x branch of the module is vulnerable to SQL injection...
