RHEL 6 / 7 / 8 : RH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 7 (Important) (RHSA-2020:2814)

The remote Redhat Enterprise Linux 6 / 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2814 advisory. Packages: Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 7.3 Security Fixes: keycloak: Lack of check...

RHEL 6 / 7 : RH-SSO 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 (Important) (RHSA-2020:2816)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2816 advisory. Packages: Red Hat Single Sign-On 7.4.1 adapters for Red Hat JBoss Enterprise Application Platform 6 Security Fixes: keycloak: Lack of checks in...

CVE-2020-5580

Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors...

CVE-2020-5580

Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors...

Authentication flaw

Cybozu Garoon 4.0.0 to 5.0.1 allows remote authenticated attackers to bypass access restriction to view and/or alter Single sign-on settings via unspecified vectors...

CVE-2020-5580

Affected software: Cybozu Garoon 4.0.0–5.0.1. Issue: CVE-2020-5580 allows remote authenticated attackers to bypass access restrictions to view and/or alter Single sign-on (SSO) settings via unspecified vectors. Root cause: bypass of SSO access controls leading to privilege escalation in SSO confi...

CVE-2020-2021

When Security Assertion Markup Language SAML authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled unchecked, improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources...

Multiple vulnerabilities in Cybozu Garoon

Overview Cybozu, Inc. has released security updates for Cybozu Garoon. CyVDB-2083 Vulnerability in Single sign-on settings to avoid viewing and operation privileges - CVE-2020-5580 CyVDB-2451 Path traversal vulnerability on the portal - CVE-2020-5581 CyVDB-2097 Vulnerability to bypass operation...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2020-4448)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Cybozu Garoon View and Operate Privileges Vulnerability

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A security vulnerability exists in the single sign-on settings in Cybozu Garoon versions 4.0.0 through 5.0.1. The...

Unspecified Vulnerability in Mattermost Mobile Apps

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. A security vulnerability exists in Mattermost Mobile Apps prior to version 1.29.0 iOS, which can be exploited by an attacker to gain access to information because the program does not clear the SSO cookie and local...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2017-18906

Summary: Mattermost Server versions before 4.0.0, 3.10.2, and 3.9.2 are affected by a vulnerability in Single Sign-On OAuth2 that could allow an attacker to claim another user’s account. The connected Red Hat, OSV, CNVD, and NVD references corroborate the issue; however, the provided documents do...

CVE-2017-18906

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account...

CVE-2020-14451

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...

Design/Logic Flaw

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...

CVE-2020-14451

CVE-2020-14451 describes a flaw in Mattermost Mobile Apps (iOS) prior to version 1.29.0 where Single Sign-On cookies and Local Storage were not cleared on logout, potentially allowing access to residual authentication state after sign-out. The issue is due to the app not clearing SSO cookies/loca...

CVE-2020-14451

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...

PT-2020-8452

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 4.0.0 Mattermost Server version 3.10.2 Mattermost Server version 3.9.2 Description: An issue was discovered when Single Sign-On OAuth2 is used, allowing an attacker to claim somebody else's account...

What's the Best Approach to SSO and Consumer Session Management for Your Businesses?

If you want to see an argument break out among identity professionals, mention single sign-on SSO and consumer session management. As fast as this technology's evolved is as fast as it's become one of the most contentiously debated topics in the field. As a senior customer identity and access...