2326 matches found
PT-2025-16904
Name of the Vulnerable Software and Affected Versions Zulip versions prior to 10.2 Description A bug in the Zulip server allows account creation without authenticating with the configured Single Sign-On SSO authentication backend in organizations where account creation is limited solely by SSO...
[SECURITY] Fedora 40 Update: lemonldap-ng-2.21.0-1.fc40
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 41 Update: lemonldap-ng-2.21.0-1.fc41
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 42 Update: lemonldap-ng-2.21.0-1.fc42
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
Rancher 访问控制错误漏洞
Rancher is an open source container management platform from the US-based Rancher Open Source, built for organizations that deploy containers in production environments. An access control error vulnerability exists in Rancher versions prior to 2.8.0 to 2.8.13, 2.9.0 to 2.9.7, and 2.10.0 to 2.10.3...
ServiceNow SAML Single Sign-On Bypass
ServiceNow enables a page named sidedoor.do by default to allow users bypassing the Single Sign On SSO feature in case of issues to still access their ServiceNow instance. No source data...
CVE-2024-13772
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fbajaxloginorregister and googleajaxloginorregist...
CVE-2024-13772 Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass
The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.1.6.1. This is due to a lack of password randomization and user validation through the fbajaxloginorregister and googleajaxloginorregist...
CVE-2024-13772
CVE-2024-13772 affects the Civi – Job Board & Freelance Marketplace WordPress Theme plugin for WordPress. Affected versions up to 2.1.6.1 suffer an authentication bypass due to non-randomized passwords for SSO (Google/Facebook) and insufficient user validation via fb_ajax_login_or_register and go...
WordPress Civi theme <= 2.1.4 - Authentication Bypass via Non-Randomized Password for SSO Accounts vulnerability
Authentication Bypass via Non-Randomized Password for SSO Accounts vulnerability discovered by Lucio Sá in WordPress Theme Civi versions = 2.1.4...
WordPress plugin Civi 访问控制错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control...
Terraform Enterprise’s Single Sign-On and Ruby SAML’s CVE-2025-25291 and CVE-2025-25292
Summary Terraform Enterprise’s single sign-on functionality is implemented using the Ruby SAML library, which disclosed two authentication bypass vulnerabilities exploitable by an XML signature wrapping attack. The vulnerabilities, CVE-2025-25291 and CVE-2025-25292, were addressed by an upgrade o...
CVE-2025-25293
ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service DoS with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is...
UBUNTU-CVE-2025-25292
ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely...
CVE-2025-25293 ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
ruby-saml provides security assertion markup language SAML single sign-on SSO for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service DoS with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is...
GHSA-4VC4-M8QH-G8JM
creationtimestamp| type| source ---|---|--- 2025-03-12 20:07:18+00:00| seen| https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/ 2025-03-12 20:42:37+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7376 2025-03-13...
PT-2025-11128 · Ruby-Saml +3 · Ruby-Saml +3
Name of the Vulnerable Software and Affected Versions: ruby-saml versions prior to 1.12.4 and 1.18.0 Description: The issue is related to the ruby-saml library, which provides security assertion markup language SAML single sign-on SSO for Ruby. The library is susceptible to remote Denial of Servi...
CVE-2025-27641
Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sign On V-2024-009...