DOKEOS SSO Authentication Bypass Vulnerability

Dokeos is an open source online education and course management system. A security vulnerability exists in DOKEOS. The vulnerability is caused by a variable type obfuscation error when comparing passwords to unserializable strings during authentication, SSO authentication is not possible...

CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005

This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...

How do I Configure Unified Gateway for Common Enterprise Applications

This article describes how to configure Unified Gateway for common enterprise applications. Use Case To do AAA and single sign-on for common enterprise applications like SharePoint or Exchange at NetScaler Unified Gateway. Unified Gateway is a single point of access for all corporate applications...

SAML Raider - SAML2 Burp Extension

SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates. This software was created by Roland Bischofberger and Emanuel Duss during a bachelor thesis at the Hochschule für Technik...

How to Authenticate Multiple Domains using NetScaler with ICA Proxy and Single Sign-on

...

How to Manually Install and Configure Citrix Receiver for Pass-Through Authentication

Citrix Workspace app is the new universal app for all workspace services, that will encompass all Citrix clients and app capabilities over time. This article describes how to install Citrix Receiver for Windows and configure Single Sign-on authentication to XenApp/XenDesktop. After configuring...

Apache CXF SAML Web SSO Module Authentication Bypass Vulnerability

Apache CXF is an open source service framework for the use of JAX-WS, JAX-RS and other front-end programming API compilation and development services. A security vulnerability in the SAML Web SSO module of Apache CXF allows remote attackers to bypass authentication by constructing specially craft...

[SECURITY] Fedora 21 Update: ipsilon-1.1.1-2.fc21

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 22 Update: ipsilon-1.1.1-2.fc22

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 23 Update: ipsilon-1.1.1-2.fc23

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

[SECURITY] Fedora 23 Update: ipsilon-1.0.0-5.fc23

Ipsilon is a multi-protocol Identity Provider service. Its function is to bridge authentication providers and applications to achieve Single Sign On and Federation...

PT-2015-3314

Name of the Vulnerable Software and Affected Versions VMware vCenter Server versions 5.5 before U3e and 6.0 before U2a VMware vRealize Automation versions 6.x before 6.2.5 Description The issue is related to the Single Sign-On feature in VMware products, specifically an XML External Entity XXE...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06838)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle. An unspecified vulnerability exists in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, 12.2.4. Allows remote attackers to affect confidentiality via unspecified vectors related to sing...

Unspecified Vulnerability in Oracle E-Business Suite (CNVD-2015-06836)

Oracle E-Business Suite is a fully integrated set of global business management software from Oracle. An unspecified vulnerability exists in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, 12.2.4. Allowing a remote attacker to pass unspecified vectors related to single sign-on would compromise...

BlackHat topics: SMBS not only to share your files-bug warning-the black bar safety net

In this paper, we show a new attack method to crack the Windows SSO Single Sign On feature, affecting all versions of Windows including the latest Windows 10, Microsoft's SMB（Server Message Block Protocol, within the network to attack the SMB technology has appear a long time, this new type of...

New Google Drive Phishing Scam Uncovered

Phishers have again leveraged users’ trust in Google with a newly discovered campaign designed to steal credentials that grant access to the multitude of Google’s online services. New phishing pages hosted on Google Drive were discovered by researcher Aditya K. Sood of Elastica Cloud Threat Labs...

Oracle Access Manager Multiple Vulnerabilities (July 2015 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities : - An unspecified flaw exists in the Configuration Service subcomponent that allows a remote, authenticated attacker to impact confidentiality and integrity. CVE-2015-2593 - An unspecified...

Design/Logic Flaw

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

PT-2015-4482

Name of the Vulnerable Software and Affected Versions IBM Rational Requirements Composer versions 3.0 through 3.0.1.6 IBM Rational Requirements Composer versions 4.0 through 4.0.7 Rational DOORS Next Generation RDNG versions 4.0 through 4.0.7 Rational DOORS Next Generation RDNG versions 5.0 throu...

CVE-2015-0121: Undefined Security Weakness

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...