Security Bulletin: A security vulnerability has been identified in IBM® SDK, Java™ Technology Edition shipped with IBM Security Access Manager for Enterprise Single Sign-On

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 7 that is used by IBM Security Access Manager for Enterprise Single Sign-On. These issues were disclosed as part of the IBM Java SDK updates in January 2016 and includes the vulnerability...

Security Bulletin: GNU C library (glibc) vulnerability is fixed in IBM Security Access Manager for Enterprise Single Sign-On Virtual Appliance (CVE-2015-0235)

Summary GNU C library glibc vulnerability that has been referred to as GHOST affects IBM Security Access Manager for Enterprise Single Sign-On Virtual Appliance ISAM ESSO VA Vulnerability Details CVEID: CVE-2015-0235 DESCRIPTION: glibc is vulnerable to a heap-based buffer overflow, caused by...

Security Bulletin: Multiple vulnerabilities in IBM SPSS Modeler (CVE-2013-6739, CVE-2013-5372, CVE-2013-5825)

Summary Vulnerabilities have been identified in IBM SPSS Modeler which make the product vulnerable to an incorrect Single Sign On being accepted on UNIX and a denial of service attack triggered by a malicious XML data. Vulnerability Details VULNERABILITY DETAILS: CVEID: CVE-2013-6739 DESCRIPTION:...

Adobe Acrobat/Reader NTLM SSO Hash Theft Vulnerability

Adobe Acrobat and Reader are the United States of America Audobee Adobe company's products. The former is a set of PDF file editing and conversion tools, the latter is a set of PDF document reading software. Adobe Acrobat/Reader NTLM SSO hash theft vulnerability. Attackers can use the vulnerabili...

Oracle Access Manager Multiple Vulnerabilities (Apr 2018 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid109733; scriptversion"1.8";...

Pivotal Spring Cloud SSO Connector Authentication Vulnerability

Pivotal Spring Cloud SSO Connector is a single sign-on connector for Cloud Foundry from Pivotal Software. A security vulnerability exists in Pivotal Spring Cloud SSO Connector version 2.1.2. An attacker can exploit the vulnerability to authenticate to an unbound resource server...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.2 security update

Red Hat Single Sign-On 7.2.2 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

How Can Manufacturing Companies Improve Network Access and Security?

The manufacturing industry faces complex challenges other sectors of the economy need not worry about. Manufacturers rely heavily on everything from positive global economic trends to laws that lift certain burdens. And companies involved with manufacturing consistently focus on increased...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...

Flaw in Microsoft Outlook Lets Hackers Easily Steal Your Windows Password

A security researcher has disclosed details of an important vulnerability in Microsoft Outlook for which the company released an incomplete patch this month—almost 18 months after receiving the responsible disclosure report. The Microsoft Outlook vulnerability CVE-2018-0950 could allow attackers ...

Climbing the Ladder: Zero Trust, Single Sign-On, Multiple Applications

It is understood that there is a significant amount of complexity to securing today's enterprise, especially as more services and applications move to the cloud and a Zero Trust security model is employed. We at Akamai are actively engaged in helping enterprises adjust to a Zero Trust security...

Microsoft Outlook retrieves remote OLE content without prompting

Overview When a Rich Text RTF email is previewed in Microsoft Outlook, remotely-hosted OLE content is retrieved without requiring any additional user interaction. This can leak private information including the user's password hash, which may be cracked by an attacker. Description Microsoft Outlo...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.1 security update

Red Hat Single Sign-On 7.2.1 is now available for download from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

IBM Tivoli Federated Identity Manager SSO XML Parsing Vulnerability

IBM Tivoli Federated Identity Manager is an access management solution that provides Web and federated SSO to end users across multiple applications. An XML parsing vulnerability exists in the Security Assertion Markup Language SAML-based single sign-on SSO system in IBM Tivoli Federated Identity...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

OXID eSales OXID eShop Spoofing Vulnerability

OXID eSales OXID eShop is a set of e-commerce content management system of Germany OXID eSales company. The system includes B2C, B2B and other modules. A spoofing vulnerability exists in the OpenID Single Sign-On authentication feature in OXID eSales OXID eShop versions prior to 4.5.0. A remote...

Authentication flaw

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token...

CVE-2015-6926

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token...

Multiple HPE IceWall Products Information Disclosure Vulnerabilities

HPE IceWall SSO Dfw and others are products of Hewlett Packard Enterprise HPE, U.S.A. HPE IceWall SSO Dfw is a set of single sign-on software.IceWall MCRP is a reverse proxy software. An information disclosure vulnerability exists in multiple HPE IceWall products. A remote attacker could exploit...