SAML SP Single Sign On < 5.0.5 - Missing Authorization to notice dismissal

Description The SAML SP Single Sign On plugin for WordPress is vulnerable to unauthorized notice dismissal due to a missing capability check on the closewelcomemodal function in versions up to, and including, 5.0.4. This makes it possible for authenticated attackers, with subscriber-level access...

Atlassian Crowd Security Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd version 3.4.6 that stems from the...

Atlassian SAML Single Sign-On Bypass

When the resolution Reichert Network Solutions GmbH plugin is used for SSO authentication on Atlassian Jira Server, Atlassian Jira Data Center, Atlassian Confluence Server, Atlassian Confluence Data Center, Atlassian Bitbucket Server, Atlassian Bitbucket Data center, Atlassian Bamboo 5 and...

Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks

A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks. "Starting from a single compromised machine, threat actors could...

Cisco Firepower Threat Defense Security Vulnerability

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. A security vulnerability exists in the Cisco Adaptive Security Appliance and Cisco Firepower Threat Defense that stems from a vulnerability in the Security Assertion Marku...

PT-2023-7130 · Cisco · Cisco Ftd +1

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software affected versions not specified Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to the implementation of Security Assertion Markup...

CVE-2023-27132

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

CVE-2023-27132

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

Default credentials

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

PT-2023-20970 · Tsplus · Tsplus Remote Work

Name of the Vulnerable Software and Affected Versions: TSplus Remote Work version 16.0.0.0 Description: The issue concerns the storage of a cleartext password in the HTML source code of the secure single sign-on web portal. Specifically, the password is placed on the var pass line. Recommendation...

CVE-2023-27132

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

TSplus Security Vulnerabilities

TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus Remote Work version 16.0.0.0, which originates from a plaintext password placed on the var pass of the HTML source code of the secure single sign-on web portal...

CVE-2023-27132

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

The vulnerability of the Single Sign-On (SSO) implementation of the Asset Suite EAM, a tool for managing enterprise assets in the energy sector, allows a malicious actor to circumvent security restrictions and gain access to read, modify, or delete data.

The vulnerability of the Single Sign-On SSO implementation for managing enterprise asset management in the energy sector, Asset Suite EAM, is related to deficiencies in authentication procedures due to incorrect password input. Exploiting this vulnerability can allow unauthorized users to bypass...

CISA and NSA Release New Guidance on Identity and Access Management

Today, CISA and the National Security Agency NSA published Identity and Access Management: Developer and Vendor Challenges, authored by the Enduring Security Framework ESF, a CISA- and NSA-led working panel that includes a public-private cross-sector partnership. ESF aims to address risks that...

CVE-2023-4101

The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

IDM Sistemas QSige Security Vulnerability

IDM Sistemas QSige is a communication management system from IDM Sistemas. A security vulnerability exists in QSige login SSO that stems from the absence of an access control mechanism to verify that the user requesting the resource has sufficient privileges to perform this operation...

CVE-2023-3115

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositori...

Code injection

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositori...

CVE-2023-3115 Incorrect User Management in GitLab

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositori...