CVE-2022-30215

Active Directory Federation Services Elevation of Privilege Vulnerability...

Privilege escalation

Active Directory Federation Services Elevation of Privilege Vulnerability...

CVE-2022-30215

CVE-2022-30215 is identified in the provided documents as an Active Directory Federation Services Elevation of Privilege vulnerability. The NVD entry lists both CVSS v2 and CVSS v3.1 metrics (base scores 8.5 and 7.5 respectively) indicating NETWORK attack vector; CVSSv2 shows MEDIUM exploit compl...

PT-2022-3844 · Microsoft · Active Directory Federation Services +1

Name of the Vulnerable Software and Affected Versions: Active Directory Federation Services affected versions not specified Description: The issue is related to insufficient access restrictions in Active Directory Federation Services AD FS on Windows operating systems. It allows a remote attacker...

IBM Security Verify Access Cross-Site Scripting Vulnerability (CNVD-2022-87651)

IBM Security Verify Access ISAM is a service from IBM USA that improves user access security. The service enables secure and simple access to platforms such as Web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated access management controls,...

MAL-2022-1057 Malicious code in apollo-federation-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5201e2567b87839a5bb3c1c2dd4c7c9b275c284349ff04a9c2b348451b979206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apollo-federation-ruby (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5201e2567b87839a5bb3c1c2dd4c7c9b275c284349ff04a9c2b348451b979206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-30584

Archer Platform 6.3 before 6.11 6.11.0.0 contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system. 6.10 P3 6.10.0.3 and 6.9 SP3 P4 6.9.3.4 are also fixed releases...

Archer Platform 安全漏洞

Archer Platform is a modern integrated risk management solution from Archer, Inc. A security vulnerability exists in Archer Platform versions 6.3 through 6.11 that stems from incorrect access control in the SSO ADFS functionality. A malicious user may be able to exploit this vulnerability to...

PT-2022-20189 · Rsa · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions 6.3 through 6.10 before 6.10.0.3 Archer Platform versions 6.9 through 6.9.3 before 6.9.3.4 Archer Platform versions prior to 6.11.0.0 Description: The issue is related to an Improper Access Control Vulnerability withi...

Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

GHSA-CPPW-2MF8-QPM5 Improper Verification of Cryptographic Signature in matrix-synapse

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /sendjoin, /sendleave, and /invite may not be correctly signed, or may not come from the expected servers...

GHSA-9PF7-F47Q-MWPQ Cross-site Scripting in RabbitMQ

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious use...

Improper Authentication in Apache Qpid

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

GHSA-9QHQ-J4XM-CW48 PicketLink does not properly check role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.7.1.Final does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a 1 direct request or 2...

OpenStack Horizon Cross-site Scripting (XSS)

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping...

GHSA-VMCC-4P4X-X7WG Matrix Synapse DoS

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 263 - 1 render rooms unusable, related to federation/federationbase.py and handlers/message.py, as exploited in the wild in April 2018...

Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...

GHSA-V8WM-G9F2-XJV4 Matrix Synapse Security Filtering Flaw

The ongetmissingevents function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the getmissingevents federation API where event visibility rules were not applied correctly...