665 matches found
CVE-2018-6519: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp...
SimpleSAMLphp SAML2 Library Denial of Service Vulnerability
SimpleSAMLphp is a program written in native PHP to handle authentication. The SAML2 stock in SimpleSAMLphp is vulnerable to a regular expression denial of service vulnerability. The vulnerability arises due to fraction-of-seconds data in timestamp. An attacker can exploit this vulnerability to...
Use of insecure connection charset (sqlauth module)
More info at https://simplesamlphp.org/security/201801-03...
Open redirection protection bypass
More info at https://simplesamlphp.org/security/201801-02...
Debian DLA-1205-1 : simplesamlphp security update
The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information disclosure. CVE-2017-12867 The SimpleSAMLAuthTimeLimitedToken class allows attackers with access to a secret token to extend its validity period by...
[SECURITY] [DLA 1205-1] simplesamlphp security update
Package : simplesamlphp Version : 1.9.2-1+deb7u1 CVE ID : CVE-2017-12867 CVE-2017-12868 CVE-2017-12869 CVE-2017-12872 CVE-2017-12873 CVE-2017-12874 The simplesamlphp package in wheezy is vulnerable to multiple attacks on authentication-related code, leading to unauthorized access and information...
DLA-1205-1 simplesamlphp - security update
Bulletin has no description...
Signature validation bypass (SAML 1.1)
More info at https://simplesamlphp.org/security/201710-01...
Cross-site Scripting (XSS)
simplesamlphp is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute a malicious Javascript document through the url when the url is being redirected...
XML External Entity Processing (XXE)
simplesamlphp/saml2 is vulnerable to XML external entity processing XXE attacks. The attacks are possible because it does not use SAML2DOMDocumentFactory to create DOMDocuments from a string containing XML and does not call libxmldisableentityloader before calling any code...
SimpleSAMLphp CBC Mode Encryption Unauthentication Vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider features . A security vulnerability exists in SimpleSAMLphp 1.14.12 and earlier versions. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack a...
SimpleSAMLphp multiauth module authentication bypass vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement SAML 2.0 Service Provider and Identity Provider functionality . multiauth module is one of the installed authentication module . A security vulnerability exists in the multiauth module in SimpleSAMLphp 1.14.13 and earlier...
SimpleSAMLphp PHP Session Fixation Vulnerability
SimpleSAMLphp is a suite of PHP authentication applications that implement the SAML 2.0 Service Provider and Identity Provider functionality.PHP is an open source general-purpose computer scripting language used in... A security vulnerability exists in the secureCompare method in SimpleSAMLphp...
SimpleSAMLphp Incorrect Authentication Vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider functionality . A security vulnerability exists in SimpleSAMLphp versions 1.7.0 through 1.14.10. An attacker can exploit the vulnerability to obtain sensitive information a...
SimpleSAMLphp InfoCard Module Spoofing Vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A spoofing vulnerability exists in the InfoCard module in SimpleSAMLphp version 1.0 due to the program failing to properly check the return value in signature...
SimpleSAMLphp Security Bypass Vulnerability (CNVD-2017-24382)
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A security bypass vulnerability exists in SimpleSAMLphp 1.14.x through 1.14.11, which can be exploited by attackers to bypass security restrictions and perform...
SimpleSAMLphp Information Disclosure Vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . An information disclosure vulnerability exists in SimpleSAMLphp versions 1.7.0 through 1.14.10, which can be exploited by attackers to obtain sensitive information...
SimpleSAMLphp authcrypt module timed side channel attack vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A timing side channel attack vulnerability exists in the authcrypt module in SimpleSAMLphp 1.14.11 and earlier versions, which can be exploited by an attacker who...
Input validation
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12873
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...