Unspecified Vulnerability in Hydra

Hydra is a penetration testing tool. A security vulnerability exists in Hydra versions prior to 1.4.0 that stems from the program not checking the uniqueness of the 'jti' value. An attacker can exploit the vulnerability to replay a token...

PT-2020-18389 · Ory · Hydra

Name of the Vulnerable Software and Affected Versions: Hydra versions prior to 1.4.0+oryOS.17 Description: The issue concerns Hydra, an OAuth2 Server and OpenID Certified OpenID Connect Provider written in Go. When using the client authentication method 'private key jwt', Hydra does not check the...

Replay Attack

sustainsys.saml2 is vulnerable to replay attack. Inadequate and insecure implementation of the token replay detection allows an attacker to replay authentication tokens in the Single Sign On solutions...

GHSA-G6J2-CH25-5MMV Missing Token Replay Detection in Saml2 Authentication services for ASP.NET

Impact Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use...

Missing Token Replay Detection in Saml2 Authentication services for ASP.NET

Impact Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use...

CVE-2020-5261

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

CVE-2020-5261

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

CVE-2020-5261

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

Authentication flaw

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

CVE-2020-5261

The CVE concerns Sustainsys.Saml2 (ASP.NET, NuGet) versions greater than 2.0.0 and less than 2.5.0, which have a faulty Token Replay Detection implementation. Token Replay Detection is cited as a defense in depth for SSO; the 2.5.0 release is patched, while 1.0.1 and earlier are reported as safe....

CVE-2020-5261 Missing Token Replay Detection

Saml2 Authentication services for ASP.NET NuGet package Sustainsys.Saml2 greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patche...

Unspecified Vulnerability in Saml2 Authentication services for ASP.NET

Saml2 Authentication services for ASP.NET is a SAML Security Assertion Markup Language authentication service for ASP.NET. A security vulnerability exists in Saml2 Authentication services for ASP.NET in version 2.0.0 and later fixed in version 2.5.0, which stems from the program's failure to...

PT-2019-2081 · Palo Alto Networks · Globalprotect Agent

Name of the Vulnerable Software and Affected Versions: GlobalProtect Agent version 4.1.0 for Windows GlobalProtect Agent versions 4.1.10 and earlier for macOS Description: The issue is related to weaknesses in the authentication procedure of the GlobalProtect Agent, which may allow a local...

CVE-2018-19249

The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens XMLHttpRequest data, parsing the response under the object card, and reading the cvccheck information if the creation is successful without charging the actual card used in the...

CVE-2018-1127

CVE-2018-1127 affects Tendrl API in Red Hat Gluster Storage prior to 3.4.0, where session tokens are not immediately invalidated on logout and remain usable for a short window. This allows an attacker who captured tokens (e.g., via sniffing/MITM) to replay them and authenticate as the target user...

CVE-2016-6582

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification...

DEBIAN-CVE-2016-6582

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification...

Design/Logic Flaw

Zimbra Collaboration Suite ZCS 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZMAUTHTOKEN token...

CVE-2006-7200

EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token...