Facebook Finds 'No Evidence' Hackers Accessed Connected Third-Party Apps

When Facebook last weekend disclosed a massive data breach—that compromised access tokens for more than 50 million accounts—many feared that the stolen tokens could have been used to access other third-party services, including Instagram and Tinder, through Facebook login. Good news is that...

The Facebook Hack Is an Internet-Wide Failure

Major sites using Facebook's Single Sign-On don't implement basic security features, potentially making the fallout of last week's hack much worse...

Microsoft Windows Server ADFS Server-Side Request Forgery Vulnerability

Microsoft Active Directory Federation Services ADFS is an Active Directory Federation Service from Microsoft. The service provides Web Single Sign-On SSO technology, which enables authentication of a user to multiple websites or applications during a single session. A server-side request forgery...

RHEL 7 : Red Hat Single Sign-On 7.1 update on RHEL 7 (Moderate) (RHSA-2017:0873)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0873 advisory. Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-o...

RHEL 6 : Red Hat Single Sign-On 7.1 update on RHEL 6 (Moderate) (RHSA-2017:0872)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0872 advisory. Red Hat Single Sign-On is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-o...

August 30, 2018—KB4343894 (Preview of Monthly Rollup)

None None...

IBM Security Access Manager for Enterprise Single Sign-On Information Disclosure Vulnerability

IBM Security Access Manager for Enterprise Single Sign-On ISAM ESSO is a suite of identity and access management software from IBM in the United States that provides single sign-on. A security vulnerability exists in IBM ISAM ESSO version 8.2.2 that stems from the program's failure to set securit...

Java System Solutions SSO plugin for BMC MyIT Cross Site Scripting Vulnerability

Java System Solutions SSO plugin for BMC MyIT is a single-sign-on plugin for BMC MyIT from Java System Solutions, UK. A cross-site scripting vulnerability exists in Java System Solutions SSO plugin for BMC MyIT version 4.0.13.1. A remote attacker can exploit this vulnerability to inject client-si...

Authorization

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2017-1732

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

CVE-2017-1732

CVE-2017-1732 affects IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2.2, where authorization tokens or session cookies are not marked as Secure. This enables potential disclosure of cookie values if a user clicks an http link or visits a page containing such a link, allo...

PT-2018-6495

Name of the Vulnerable Software and Affected Versions: IBM Security Access Manager for Enterprise Single Sign-On version 8.2.2 Description: The issue allows attackers to obtain cookie values by sending a http link to a user or planting this link in a site the user visits. When the user clicks the...

CVE-2017-1732: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Access Manager for Enterprise Single Sign-On 8.2.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be...

Security Bulletin: A security vulnerability has been fixed in IBM Security Access Manager for Enterprise Single-Sign On (CVE-2017-1732)

Summary IBM Security Access Manager for Enterprise Single-Sign On does not set the secure attribute on authorization tokens or session cookies. Vulnerability Details CVEID: CVE-2017-1732 DESCRIPTION: IBM Security Access Manager for Enterprise Single-Sign On does not set the secure attribute on...

Security Bulletin: Multiple Vulnerabilities found in products bundled with IBM Security Access Manager for Enterprise Single-Sign On

Summary IBM HTTP Server is shipped as a component of IBM Security Access Manager for Enterprise Single-Sign On. Information about Security vulnerabilities affecting IBM HTTP Server Vulnerability Details Security Bulletin: Information disclosure in IBM HTTP Server CVE-2017-12613 Security Bulletin:...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.2.4 security update

A security update is now available for Red Hat Single Sign-On 7.2 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Security Bulletin: Multiple Vulnerabilities found in products bundled with IBM Security Access Manager for Enterprise Single-Sign On

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Security Access Manager for Enterprise Single-Sign On. Information about Security vulnerabilities affecting IBM® SDK, Java™ Technology Edition. Vulnerability Details Security Bulletin: Multiple vulnerabilities may affect...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.2 security update

A security update is now available for Red Hat Single Sign-On 7.2 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Enable your users to work securely from anywhere, anytime, across all of their devices

This blog is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 Security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog, Assessing...

Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability

Microsoft Active Directory Federation Services ADFS is an Active Directory Federation Service from Microsoft. The service provides Web Single Sign-On SSO technology, which enables authentication of a user to multiple websites or applications during a single session. A cross-site scripting...