How to Manually Install and Configure Citrix Receiver for Pass-Through Authentication

Citrix Workspace app is the new universal app for all workspace services, that will encompass all Citrix clients and app capabilities over time. This article describes how to install Citrix Receiver for Windows and configure Single Sign-on authentication to XenApp/XenDesktop. After configuring...

tentown.co.uk XSS vulnerability

Vulnerable URL: https://www.tentown.co.uk/signin.php?message=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

Apache CXF SAML Web SSO Module Authentication Bypass Vulnerability

Apache CXF is an open source service framework for the use of JAX-WS, JAX-RS and other front-end programming API compilation and development services. A security vulnerability in the SAML Web SSO module of Apache CXF allows remote attackers to bypass authentication by constructing specially craft...

[SECURITY] Fedora 21 Update: ipsilon-1.1.1-2.fc21

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 22 Update: ipsilon-1.1.1-2.fc22

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 23 Update: ipsilon-1.1.1-2.fc23

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 23 Update: ipsilon-1.0.0-5.fc23

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

PT-2015-3314

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a VMware vRealize Automation versions 6.x before 6.2.5 Description The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity XXE...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06838)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle. An unspecified vulnerability exists in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4. Allows remote attackers to affect confidentiality via unspecified vectors related to sing...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06836)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle. An unspecified vulnerability exists in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, 12.2.4. Allowing a remote attacker to pass unspecified vectors related to single sign-on would compromise...

HackerOne: HackerOne Private Programs users disclosure and de-anonymous-ize

Hi HackerOne Team, I have found a bug in HackerOne Platform allows any attacker to deanonymousize any security researcher using the platform and the most wild usage is to disclose some information about this security researcher if he is invited to a private program or not. Unfortunately HackerOne...

Imgur: "Sign me out everywhere" does not work for desktop sessions

An account option that allowed users to sign out everywhere was found to not be functioning properly. A user selecting this option was not signed out. A fix has been rolled out to update session security as a result of this report...

CVE-2015-5689: Improper Restriction of Operations within the Bounds of a Memory Buffer

ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite GSS before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution DS before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code,...

BlackHat topics: SMBS not only to share your files-bug warning-the black bar safety net

In this paper, we show a new attack method to crack the Windows SSO Single Sign On feature, affecting all versions of Windows including the latest Windows 10, Microsoft's SMB（Server Message Block Protocol, within the network to attack the SMB technology has appear a long time, this new type of...

PT-2015-7036

Name of the Vulnerable Software and Affected Versions Symantec Ghost Solutions Suite GSS versions prior to 3.0 HF2 12.0.0.8010 Symantec Deployment Solution DS versions prior to 7.6 HF4 12.0.0.7045 Description The issue is related to improper sign-extend operations before array-element accesses in...

New Google Drive Phishing Scam Uncovered

Phishers have again leveraged users’ trust in Google with a newly discovered campaign designed to steal credentials that grant access to the multitude of Google’s online services. New phishing pages hosted on Google Drive were discovered by researcher Aditya K. Sood of Elastica Cloud Threat Labs...

Zendesk: Security Missconfiguration in Autologin

Here I am addressing Critical misconfiguration in autologin feature 1. Open the link in the browser https://dashboard.zopim.com/home and enter your username and password and don't tick select the option Always sign in automatically and login 2. now logout from your account 3. now you logged out...

Oracle Access Manager Multiple Vulnerabilities (July 2015 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities : - An unspecified flaw exists in the Configuration Service subcomponent that allows a remote, authenticated attacker to impact confidentiality and integrity. CVE-2015-2593 - An unspecified...

You Can Now Use Messenger App without a Facebook Account

Don't have Facebook account but want to use its Messenger service? Then go for it because Mark Zuckerberg wants even the people who hate Facebook to use the social network's separate Messenger service. So, you no longer need an active Facebook account to make use of the Messenger service, all you...

PT-2015-6581

Name of the Vulnerable Software and Affected Versions Nextend Facebook Connect plugin versions prior to 1.5.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the redirect to parameter in the new fb...