Information disclosure

Microsoft Active Directory Federation Services AD FS 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by...

CVE-2013-3185

CVE-2013-3185 affects Microsoft Active Directory Federation Services (AD FS) versions 1.x through 2.1 on Windows Server 2003 R2 SP2, 2008 SP2 and R2 SP1, and 2012. The vulnerability allows remote attackers to disclose information about the AD FS service account, potentially enabling account-locko...

CVE-2013-3185

Microsoft Active Directory Federation Services AD FS 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (2873872)

This host is missing an important security update according to Microsoft Bulletin MS13-066. OpenVAS Vulnerability Test $Id: secpodms13-066.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Active Directory Federation Services Information Disclosure Vulnerability 2873872 Authors: Veerendra G.G...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (2873872)

This host is missing an important security update according to Microsoft Bulletin MS13-066. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Active Directory Federation Services information leakage

It's possible to obtain service account information to cause account locking via unsuccessful logon attempts...

MS13-066: Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (2873872)

The remote Windows host is affected by an unspecified vulnerability in the Active Directory Federation Services AD FS that may allow an attacker to obtain the AD FS instance account information. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid69331; scriptversion"1.10...

MS13-066: Vulnerability in Active Directory Federation Services could allow information disclosure: August 13, 2013

Resolves a vulnerability in Active Directory Federation Services AD FS that could reveal information that relates to the service account that is used by AD FS.INTRODUCTIONMicrosoft has released security bulletin MS13-066. To view the complete security bulletin, go to the following Microsoft...

Microsoft Active Directory Federation Services CVE-2013-3185 Information Disclosure Vulnerability

Description Microsoft Active Directory Federation Services is prone to an information disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPil...

MS13-066: Description of the security update for Active Directory Federation Services 1.x: August 13, 2013

None None...

MS13-066: Description of the security update for Active Directory Federation Services 2.0: August 13, 2013

None None...

Microsoft Active Directory Federation Services Information Disclosure (MS13-066; CVE-2013-3185)

An information disclosure vulnerability exists in Active Directory Federation Services AD FS that could allow the unintentional disclosure of account information...

Microsoft Windows ADFS服务单次登录功能认证欺骗漏洞（MS09-070）

BUGTRAQ ID: 37215 CVE ID: CVE-2009-2508 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的ADFS服务没有充分地验证会话管理，如果攻击者能够访问目标用户近期所使用的用于访问提供单次登录站点的工作站和Web浏览器，就可能允许攻击者扮演为通过认证的用户。 攻击者必须可以访问终端上之前用户所使用的认证令牌才可以利用这个漏洞。在启用了HTTPS服务器的情况下，认证令牌在传输中是受保护的，攻击者必须能够访问受害者的计算机（如自助终端机）才可以利用这个漏洞。在自助终端机上，用户可能登录到ADFS SSO...

CVE-2009-2509

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

Remote code execution

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

CVE-2009-2508

The single sign-on implementation in Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly remove credentials at the end of a network session, which allows physically proximate attackers to obtain the credentials of a previou...

CVE-2009-2509

Active Directory Federation Services ADFS in Microsoft Windows Server 2003 SP2 and Server 2008 Gold and SP2 does not properly validate headers in HTTP requests, which allows remote authenticated users to execute arbitrary code via a crafted request to an IIS web server, aka "Remote Code Execution...

CVE-2009-2509

In CVE-2009-2509, Active Directory Federation Services (ADFS) on Windows Server 2003 SP2 and Windows Server 2008 SP2/Gold exposes remote code execution due to incorrect validation of HTTP request headers by an authenticated user. A crafted HTTP request to an ADFS-enabled IIS web server can execut...

CVE-2009-2508

CVE-2009-2508 affects Microsoft Windows ADFS SSO: the single sign-on implementation does not properly discard credentials at end of a session, enabling physically proximate attackers to impersonate a previous user by reusing browser-cache data. Affected are Windows Server 2003 SP2 and Windows Ser...

Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution (971726)

Microsoft Security Bulletin MS09-070 - Important Vulnerabilities in Active Directory Federation Services Could Allow Remote Code Execution 971726 Published: December 08, 2009 Version: 1.0 General Information Executive Summary This security update resolves two privately reported vulnerabilities in...