Design/Logic Flaw

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Thi...

CVE-2020-27847

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Thi...

CVE-2020-27847

The CVE-2020-27847 issue is in the SAML connector of github.com/dexidp/dex, affecting Dex versions prior to 2.27.0 and enabling bypass of SAML authentication due to a flaw in Signature Validation. It impacts confidentiality, integrity, and availability. The cited mitigation is to upgrade to Dex v...

CVE-2020-27847

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Thi...

GitHub Security Lab: porcupiney.hairs : Java/Android - Insecure Loading of a Dex File

This bug was reported directly to GitHub Security Lab...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

Design/Logic Flaw

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2020-26290

Dex (Dexidp) is affected by CVE-2020-26290: before v2.27.0, vulnerabilities in XML encoding within the Go library could enable a signature bypass in the SAML connector. The issue has been addressed in Dex v2.27.0 by adopting the xml-roundtrip-validator from Mattermost. Affected and related adviso...

CVE-2020-26290 Critical security issues in XML encoding in Dex

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

Dexidp Dex Data Forgery Issue Vulnerability

Dexidp Dex is a Go-based language used for secure authentication via OpenId by the Dexidp team. Versions of Dex prior to 2.27.0 have security vulnerabilities that stem from faulty XML encoding in the underlying Go libraries, which affects the user's ability to utilize the SAML connector. These...

CVE-2020-27847

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...

Joker Trojans Flood the Android Ecosystem

More variants of the Joker Android malware are cropping up in Google Play as well as third-party app stores, in a trend that researchers say points to a relentless targeting of the Android mobile platform. Researchers at Zscaler have found 17 different samples of Joker being regularly uploaded to...

Improper access control

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. StatusBarService has insufficient DEX access control. The Samsung ID is SVE-2020-17797 August 2020...

CVE-2020-25049

CVE-2020-25049 affects Samsung mobile devices running P (9.0) and Q (10.0) software, where the StatusBarService has insufficient DEX access control. The vulnerability is documented by NVD as having a high base score (CVSS v3.1: 9.8, NETWORK, NONE user interaction, HIGH confidentiality/integrity/a...

OSV-2020-855 Use-of-uninitialized-value in read_uleb128

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6402 Crash type: Use-of-uninitialized-value Crash state: readuleb128 dexparse dexload...

Joker Malware Apps Once Again Bypass Google's Security to Spread via Play Store

Cybersecurity researchers took the wraps off yet another instance of Android malware hidden under the guise of legitimate applications to stealthily subscribe unsuspecting users for premium services without their knowledge. In a report published by Check Point research today, the malware —...

CVE-2020-13838

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 June 2020...

CVE-2020-13838

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 June 2020...