Cross site request forgery (csrf)

The non-Domino web agents in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted request...

Cross site request forgery (csrf)

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

CVE-2015-6853

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

CVE-2015-6854

The non-Domino web agents in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted request...

CVE-2015-6853

Technical details about CVE-2015-6853 are not publicly provided in the supplied documents; sources largely reiterate the vulnerability exists and can cause DoS or information disclosure. Monitor for updates.

CVE-2015-6854

CA Single Sign-On (SSO) non-Domino Web Agent affected across multiple releases: R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5. The issue allows remote attackers to trigger a denial of service (daemon crash) or access sensitive information via a crafted request. Root cau...

PT-2016-3724

Name of the Vulnerable Software and Affected Versions CA Single Sign-On versions R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5 Description The issue allows remote attackers to cause a denial of service or obtain sensitive information via a crafted request. This is related t...

PT-2016-3723

Name of the Vulnerable Software and Affected Versions CA Single Sign-On versions R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, R12.52 before SP1 CR3 Description The issue allows remote attackers to cause a denial of service or obtain sensitive informatio...

CVE-2015-6854: Insufficient Verification of Data Authenticity

The non-Domino web agents in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, and R12.5 before CR5 allow remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted request...

CVE-2015-6853: Insufficient Verification of Data Authenticity

The Domino web agent in CA Single Sign-On aka SSO, formerly SiteMinder R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service daemon crash or obtain sensitive information via a crafted...

apache-cxf: SAML SSO processing is vulnerable to wrapping attack

It was found that Apache CXF permitted wrapping attacks in its support for SAML SSO. A malicious user could construct a SAML response that would bypass the login screen and possibly gain access to restricted information or resources...

DOKEOS ce30 Authentication Bypass

Advisory ID: HTB23289 Product: DOKEOS Vendor: DOKEOS Vulnerable Versions: ce30 and probably prior Tested Version: ce30 Advisory Publication: January 7, 2016 without technical details Vendor Notification: January 7, 2016 Public Disclosure: February 17, 2016 Vulnerability Type: Improper...

DOKEOS SSO Authentication Bypass Vulnerability

Dokeos is an open source online education and course management system. A security vulnerability exists in DOKEOS. The vulnerability is caused by a variable type obfuscation error when comparing passwords to unserializable strings during authentication, SSO authentication is not possible...

Adobe Experience Manager (AEM) Detection (HTTP)

HTTP based detection of Adobe Experience Manager AEM. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...

New Relic: Unsafe HTML in reset password email and Account verification in email is missing in Sign up

Issue :1 did not receive password reset email, although it looks like newrelic delivered it to gmail. On inspection I can see that the email contains unescaped user input name that might be interfering with delivery. Issue 2 : Account verification in email is missing in Sign up...

How do I Configure Unified Gateway for Common Enterprise Applications

This article describes how to configure Unified Gateway for common enterprise applications. Use Case To do AAA and single sign-on for common enterprise applications like SharePoint or Exchange at NetScaler Unified Gateway. Unified Gateway is a single point of access for all corporate applications...

SAML Raider - SAML2 Burp Extension

SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates. This software was created by Roland Bischofberger and Emanuel Duss during a bachelor thesis at the Hochschule für Technik...

How to Authenticate Multiple Domains using NetScaler with ICA Proxy and Single Sign-on

...

Coinbase: Potential for Double Spend via Sign Message Utility

Hi, There is an unlikely but theoretically exploitable vulnerability is caused by allowing users to sign messages with their addresses. So far I have not been able to exploit this, but I believe that it is exploitable. On coinbse.com, the user can see a list of their addresses here. When they cli...