CVE-2015-3158

CVE-2015-3158 affects PicketLink in Red Hat JBoss EAP 6.x where the invokeNextValve in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java fails to enforce role-based authorization. This allows remote authenticated users to access restricted resources via a direct request or an SP-initi...

Microsoft Active Directory Federation Services crossite scripting

Crossite scipring in web interface...

Cross site scripting

Cross-site scripting XSS vulnerability in adfs/ls in Active Directory Federation Services AD FS in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability....

CVE-2015-1757

CVE-2015-1757 is an XSS elevation-of-privilege vulnerability in Microsoft Active Directory Federation Services (AD FS) exposed by wct input in AD FS on Windows Server 2008 SP2, R2 SP1, and Server 2012. The issue, described as cross-site scripting via the wct parameter, can enable a remote attacke...

MS15-062: Vulnerability in Active Directory Federation Services Could Allow Elevation of Privilege (3062577)

The remote Windows host is affected by an XSS elevation of privilege vulnerability in Active Directory Federation Services AD FS due to improper sanitization of user-supplied input. A remote attacker can exploit this by submitting a specially crafted URL to a target site, resulting in the executi...

Microsoft Active Directory Federation Services Privilege Escalation Vulnerability (3062577)

This host is missing an important security update according to Microsoft Bulletin MS15-062. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Active Directory Federation Services Cross-Site Scripting Vulnerability

Microsoft Active Directory is an Active Directory service developed by Microsoft. A cross-site scripting vulnerability exists in Microsoft Active Directory Federation Services, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to...

CVE-2015-1757: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in adfs/ls in Active Directory Federation Services AD FS in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability....

June 2015 Microsoft Patch Tuesday Security Bulletins

IT administrators today were granted a relatively light month of security bulletins from Microsoft, which is likely to be welcomed given that Windows Server 2003 security support ends in little more than a month. Microsoft today released eight bulletins, two of them rated critical, including a...

Microsoft Active Directory Federation Services CVE-2015-1757 Privilege Escalation Vulnerability

Description Microsoft Active Directory Federation Services is prone to a remote privilege-escalation vulnerability because it fails to sanitize user-supplied input. An attacker can exploit this issue to gain elevated privileges and perform unauthorized actions in the context of the currently...

MS15-062: Vulnerability in Active Directory federation services could allow elevation of privilege: June 9, 2015

None None...

The vulnerability of the Windows operating system, which allows a malicious individual to compromise the confidentiality of information

The Microsoft Windows operating system contains a vulnerability in the Active Directory services, related to incorrect handling of user exit. Exploiting this vulnerability can allow attackers to access user information by reopening the application from which the user exited. Due to the error in...

[SECURITY] Fedora 22 Update: lasso-2.4.1-3.fc22

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

Microsoft Windows ADFS Information Disclosure Vulnerability

Active Directory is a directory service for Windows Standard Server, Windows Enterprise Server, and Windows Datacenter Server. An information disclosure vulnerability exists when Active Directory Federation Services ADFS fails to properly log out a user. An attacker can exploit the vulnerability ...

Microsoft patch day 2015-4-14: the repair of many high-risk IE, Windows, Office vulnerabilities-vulnerability warning-the black bar safety net

Monthly the second Tuesday, Microsoft fixed the patch to fix the day, Microsoft on Tuesday（2015-4-14 the“patch day”on repairing a large number of vulnerabilities, which includes many IE, Windows, Office, high-risk vulnerabilities. Update announcement MS15-0 3 4 announcement MS15-0 3 4 announcemen...

Microsoft Active Directory Federation Services Information Disclosure Vulnerability (3045711)

This host is missing an important security update according to Microsoft Bulletin MS15-040. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-1638

Microsoft Active Directory Federation Services AD FS 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosur...

Information disclosure

Microsoft Active Directory Federation Services AD FS 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosur...

CVE-2015-1638

Microsoft Active Directory Federation Services AD FS 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosur...

CVE-2015-1638

CVE-2015-1638 affects Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2. The vulnerability stems from improper logoff handling, enabling an attacker with an unattended workstation to reopen an application and access information from the AD FS server. This leads to informa...