621 matches found
SimpleSAMLphp multiauth module authentication bypass vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement SAML 2.0 Service Provider and Identity Provider functionality . multiauth module is one of the installed authentication module . A security vulnerability exists in the multiauth module in SimpleSAMLphp 1.14.13 and earlier...
SimpleSAMLphp CBC Mode Encryption Unauthentication Vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider features . A security vulnerability exists in SimpleSAMLphp 1.14.12 and earlier versions. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack a...
SimpleSAMLphp PHP Session Fixation Vulnerability
SimpleSAMLphp is a suite of PHP authentication applications that implement the SAML 2.0 Service Provider and Identity Provider functionality.PHP is an open source general-purpose computer scripting language used in... A security vulnerability exists in the secureCompare method in SimpleSAMLphp...
SimpleSAMLphp Incorrect Authentication Vulnerability
SimpleSAMLphp is a set of PHP authentication applications that implement the SAML 2.0 service provider and identity provider functionality . A security vulnerability exists in SimpleSAMLphp versions 1.7.0 through 1.14.10. An attacker can exploit the vulnerability to obtain sensitive information a...
SimpleSAMLphp InfoCard Module Spoofing Vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A spoofing vulnerability exists in the InfoCard module in SimpleSAMLphp version 1.0 due to the program failing to properly check the return value in signature...
SimpleSAMLphp Information Disclosure Vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . An information disclosure vulnerability exists in SimpleSAMLphp versions 1.7.0 through 1.14.10, which can be exploited by attackers to obtain sensitive information...
SimpleSAMLphp Security Bypass Vulnerability (CNVD-2017-24382)
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A security bypass vulnerability exists in SimpleSAMLphp 1.14.x through 1.14.11, which can be exploited by attackers to bypass security restrictions and perform...
SimpleSAMLphp authcrypt module timed side channel attack vulnerability
SimpleSAMLphp is a PHP authentication application that implements the SAML2.0 service provider and identity provider functionality . A timing side channel attack vulnerability exists in the authcrypt module in SimpleSAMLphp 1.14.11 and earlier versions, which can be exploited by an attacker who...
CVE-2017-12871
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector IV...
Input validation
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12873
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...
DEBIAN-CVE-2017-12873
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...
CVE-2017-12871
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector IV...
Code injection
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...
DEBIAN-CVE-2017-12874
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12873
SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider IdP is misconfigured...
Input validation
The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...
CVE-2017-12871
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector IV...
CVE-2017-12871
The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector IV...