py-matrix-synapse -- multiple vulnerabilities

Matrix developers report: Due to the two security issues highlighted below, server administrators are encouraged to update Synapse. We are not aware of these vulnerabilities being exploited in the wild. A malicious homeserver could force Synapse to reset the state in a room to a small subset of t...

Nextcloud: Contacts menu (not app) fails to restrict (to local groups) for contacts from federated servers

In two Nextclouds A and B, in settings/admin/sharing, these settings are enabled: Restrict users to only share with users in their groups Restrict username autocompletion to users within the same groups Add server automatically once a federated share was created successfully Some user on A now...

Nextcloud: user can bypass password enforcement when federated sharing is enabled

If the admin forces password for link shares and federated shares are enabled, users can bypass this enforcement. Tested with Nextcloud 18.0.3 Steps to reproduce: - enable password enforcement for link shares as admin - as user1 create a link share with password - open the link share in a separat...

Users Prompted for Credentials on Workspace URLs When Using Federated Authentication Providers

Overview: Users may be prompted for additional authentication when navigating to Citrix Workspace URLS if Workspace is configured to use a federated identity provider. Example: Users may be prompted for Azure AD credentials when Using AAD for Authentication to Citrix Workspace, even if the user h...

SSRF in "Add to your ownCloud" functionality – ownCloud

------- It is possible to force the ownCloud server to execute GET requests against a crafted URL on the internal or external network Server Side Request Forgery after receiving a public link-share URL. The criticality of this issue is lowered because the attacker can not see the result of the...

Security Bulletin: A security vulnerability was identified in WebSphere Application Server as shipped with IBM Tivoli Federated Identity Manager (CVE-2019-4670)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security bulletin affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixe...

Design/Logic Flaw

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications...

CVE-2019-15611

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications...

Security Bulletin: Security Vulnerabilities have been identified in IBM Java Runtime as shipped with Tivoli Federated Identity Manager

Summary IBM Java Runtime as shipped with Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM Java Runtime have been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected...

Security Bulletin: Multiple Security Vulnerabilities Have Been Identified In WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: Security Vulnerability Has Been Identified In WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2019-4270)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: A Security Vulnerability Has Been Identified In WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2019-4268)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: A Security Vulnerability Has Been Identified In WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2019-10086)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: A Security Vulnerability Has Been Identified In WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2019-4441)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

FAS | Users unable to launch published application/ Desktop

Users are unable to launch published applications from a FAS enabled store. When trying to launch a published application, the receiver windows displays the message - "negotiating connection parameters" and then disappears without launching the application. Error Message in the Event Viewer...

Security Bulletin: A vulnerability has been identified in IBM Websphere Application Server shipped with IBM Tivoli Federated Identity Manager

Summary IBM Websphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting IBM Websphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Tivoil Federated Identity Manager

Summary IBM WebSphere Application Server is shipped with Tivoli Federated Identity Manager. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2019-4442 DESCRIPTION: IBM WebSphere...

Security Bulletin: Security Vulnerabilities have been identified in IBM Java Runtime as shipped with Tivoli Federated Identity Manager

Summary IBM Java Runtime ais shipped with Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IBM Java Runtime have been published in a security bulletin. Vulnerability Details CVEID: CVE-2018-12549 DESCRIPTION: In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT...

Login and token disclosure to other Nextcloud services (NC-SA-2019-017)

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when search e.g. for federated users or registering for push notifications...

Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager (CVE-2019-0211, CVE-2019-0220)

Summary IBM WebSphere Application Server WAS is shipped as a component of IBM Tivoli Security Federated Identity Manager TFIM. Information about multiple security vulnerabilities in IBM HTTP Server used by WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager have been...