CVE-2015-6254

The 1 Service Provider SP and 2 Identity Provider IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown...

CVE-2015-0277

The Service Provider SP in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due ...

CVE-2015-0277

CVE-2015-0277 affects Red Hat JBoss PicketLink (SP/IdP) prior to 2.7.0. The flaw is failure to ensure the SP is a member of an Audience when an AudienceRestriction is specified, enabling a remote attacker to log in to other users’ accounts via a crafted SAML assertion. Related issue CVE-2015-6254...

CVE-2015-6254

The 1 Service Provider SP and 2 Identity Provider IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown...

subversion: (mod_dav_svn) remote denial of service with certain requests with dynamically evaluated revision numbers

An assertion failure flaw was found in the way the SVN server processed certain requests with dynamically evaluated revision numbers. A remote attacker could use this flaw to cause the SVN server both svnserve and httpd with the moddavsvn module to crash...

Moderate: Red Hat Security Advisory: subversion security update

Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available...

PT-2015-7140

Name of the Vulnerable Software and Affected Versions PicketLink versions prior to 2.7.0 Description The issue in PicketLink allows remote attackers to have an unspecified impact. This is due to the Service Provider SP and Identity Provider IdP not ensuring that the Destination attribute in a...

CVE-2015-0277: Improper Access Control

The Service Provider SP in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due ...

CVE-2015-6254: Undefined Security Weakness

The 1 Service Provider SP and 2 Identity Provider IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown...

McAfee Firewall Enterprise DoS (SB10126)

The remote host has a version of McAfee Firewall Enterprise installed that is affected by a denial of service vulnerability due to an assertion flaw that occurs when handling TKEY queries. A remote attacker can exploit this, via a specially crafted request, to cause a REQUIRE assertion failure an...

NeuroServer 0.7.4 - EEG TCPIP Transceiver Remote Denial of Service

NeuroServer 0.7.4 - EEG TCPIP Transceiver Remote Denial of Service !/usr/bin/env python NeuroServer 0.7.4 Remote DoS Shown at DEF CON 23 BioHacking Village Brain Waves Surfing - InSecurity in EEG Electroencephalography Technologies Slides: http://goo.gl/44r1HH NeuroServer is an EEG...

NeuroServer 0.7.4 Denial Of Service

NeuroServer version 0.7.4 suffers from a remote denial of service vulnerability. !/usr/bin/env python NeuroServer 0.7.4 Remote DoS Shown at DEF CON 23 BioHacking Village Brain Waves Surfing - InSecurity in EEG Electroencephalography Technologies Slides: http://goo.gl/44r1HH NeuroServer is an EEG...

[SECURITY] [DLA 290-2] opensaml2 security update

Package : opensaml2 Version : 2.3-2+squeeze2 CVE ID : CVE-2015-0851 It was discovered that opensaml2, a Security Assertion Markup Language library, needed to be rebuilt against a fixed version of the xmltooling package due to its use of macros vulnerable to CVE-2015-0851 as fixed in the DSA 3321-...

[SECURITY] Fedora 22 Update: opensaml-java-2.5.3-9.fc22

OpenSAML is a set of open source C++ & Java libraries meant to support developers working with the Security Assertion Markup Language SAML. OpenSAML 2, the current version, supports SAML 1.0, 1.1, and 2.0...

[SECURITY] Fedora 21 Update: opensaml-java-2.5.3-9.fc21

OpenSAML is a set of open source C++ & Java libraries meant to support developers working with the Security Assertion Markup Language SAML. OpenSAML 2, the current version, supports SAML 1.0, 1.1, and 2.0...

Scientific Linux Security Update : bind on SL6.x, SL7.x i386/x86_64 (20150729)

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet. CVE-2015-5477...

Scientific Linux Security Update : bind97 on SL5.x i386/x86_64 (20150729)

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet. CVE-2015-5477...

CVE-2015-5477

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service REQUIRE assertion failure and daemon exit via TKEY queries...

bind: TKEY query handling flaw leading to denial of service

A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named functioning as an authoritative DNS server or a DNS resolver exit unexpectedly with an assertion failure via a specially crafted DNS request packet...

CVE-2015-5477: Reachable Assertion

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service REQUIRE assertion failure and daemon exit via TKEY queries...