CVE-2013-2279

The CVE-2013-2279 issue affects CA SiteMinder Federation (FSS) 12.5/12.0 and r6, Federation Standalone 12.1/12.0, Agent for SharePoint 2010, and SiteMinder for Secure Proxy Server (6.0/12.0/12.5). Root cause: inadequate verification of XML signatures in SAML statements, enabling remote attackers ...

PT-2013-3637

Name of the Vulnerable Software and Affected Versions CA SiteMinder Federation FSS versions 12.0 through 12.5 CA SiteMinder Federation Standalone versions 12.0 through 12.1 CA Agent for SharePoint 2010 CA SiteMinder for Secure Proxy Server versions 6.0 through 12.5 Description The issue concerns...

CVE-2013-2279: Improper Input Validation

CA SiteMinder Federation FSS 12.5, 12.0, and r6; Federation Standalone 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain...

CVE-2012-4446

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

UBUNTU-CVE-2012-4446

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

CVE-2012-4446

The default configuration for Apache Qpid 0.20 and earlier, when the federationtag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request...

PT-2013-1671

Name of the Vulnerable Software and Affected Versions Apache Qpid versions 0.20 and earlier Description The issue concerns the default configuration of Apache Qpid when the federation tag attribute is enabled. In this setup, the software accepts AMQP connections without verifying the source user...

qpid-cpp: qpid authentication bypass

It was found that the Apache Qpid daemon qpidd treated AMQP connections with the federationtag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connecti...

qpid-cpp: qpid authentication bypass

It was found that the Apache Qpid daemon qpidd treated AMQP connections with the federationtag attribute set as a broker-to-broker connection, rather than a client-to-server connection. This resulted in the source user ID of messages not being checked. A client that can establish an AMQP connecti...

Cross site request forgery (csrf)

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

CVE-2012-3315

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

Scientific Linux Security Update : tzdata on SL4.x, SL5.x, SL6.x i386/x86_64

This updated package addresses the following changes to Daylight Saving Time DST : - The Daylight Saving Time has been canceled in the Russian Federation in 2011 and the upcoming years. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Debian Security Advisory DSA 2387-1 (simplesamlphp)

The remote host is missing an update to simplesamlphp announced via advisory DSA 2387-1. OpenVAS Vulnerability Test $Id: deb23871.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2387-1 simplesamlphp Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft...

Persistent XSS vulnerability in eBuddy Web Messenger

Persistent XSS vulnerability in eBuddy Web Messenger A team member from Virtual Luminous Security, Russian Federation, has discovered a persistent XSS vulnerability in eBuddy the biggest web IM solution in the world by transmitting messages with embedded encoded javascript code. In-depth detail...

Mozilla Releases BrowserID Web Authentication System

Mozilla has released a new browser-based federated login mechanism called BrowserID that is designed to replace the login process on Web sites that requires users to supply an email and password. The experimental system relies on the Verified Email protocol and also works on other browsers,...

Rajasthan State marketing site infected with malicious code

India's Rajasthan State Co-operative Marketing Federation Ltd https://rajfed.gov.in/ has been infected with a malicious script tag. This government site promotes the objectives of procuring agricultural produce from farmers through the member societies on support prices declared by the Govt. of...

All India Football Federation (AIFF) Site Hacked By Hackers Pakistan !

Pak hacker support in Pakistan re-damaged sites in India, this time at the All India Football Federation AIFF Mumbai. Cyber outlaws feel "ZCompany Hacking Crew", was hit late on Thursday and turned the entire home page in a message board propaganda in India and Israel, just hours before the AIFF...

CVE-2010-2326

IBM WebSphere Application Server WAS 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about CIMMetadataCollectorImpl trace actions by reading the addNode.log file...

CVE-2010-2326: Exposure of Sensitive Information to an Unauthorized Actor

IBM WebSphere Application Server WAS 7.0 before 7.0.0.11, when addNode -trace is used during node federation, allows attackers to obtain sensitive information about CIMMetadataCollectorImpl trace actions by reading the addNode.log file...

Microsoft Windows ADFS服务单次登录功能认证欺骗漏洞（MS09-070）

BUGTRAQ ID: 37215 CVE ID: CVE-2009-2508 Microsoft Windows是微软发布的非常流行的操作系统。 Windows的ADFS服务没有充分地验证会话管理，如果攻击者能够访问目标用户近期所使用的用于访问提供单次登录站点的工作站和Web浏览器，就可能允许攻击者扮演为通过认证的用户。 攻击者必须可以访问终端上之前用户所使用的认证令牌才可以利用这个漏洞。在启用了HTTPS服务器的情况下，认证令牌在传输中是受保护的，攻击者必须能够访问受害者的计算机（如自助终端机）才可以利用这个漏洞。在自助终端机上，用户可能登录到ADFS SSO...