489 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...
CVE-2013-6957
Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...
CVE-2013-6957
CVE-2013-6957 is an XSS vulnerability in the Juniper IDP ACM Web Server’s web administration component. The issue allows remote attackers to inject arbitrary script/HTML via unspecified vectors to the ACM web server, potentially exposing sensitive information or enabling user session manipulation...
CVE-2013-6957: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the web administrative component in Juniper IDP allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the ACM web server...
Barnraiser Prairie Directory Traversal
The OpenID idp software "Barnraiser Prairie" http://www.barnraiser.org/prairie/ is vulnerable to directory traversal attacks: ./getfile.php does not limit the given path and allows directory traversal attacks with full public access to all images on the server. Example exploit:...
CVE-2012-2351
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...
Default configuration
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...
CVE-2012-2351: Improper Access Control
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...
CVE-2011-1411
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
CVE-2011-1411
Removed by vendor...
CVE-2009-5086
Cross-site scripting XSS vulnerability in Appliance Configuration Manager ACM in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-5086
CVE-2009-5086 concerns an XSS vulnerability in Juniper IDP ACM (Appliance Configuration Manager). Affected are IDP versions prior to 4.1r3 and prior to 4.2r1, where an attacker can inject arbitrary web script or HTML via unspecified vectors in the ACM web interface. The practical impact is that a...
CVE-2009-5086
Cross-site scripting XSS vulnerability in Appliance Configuration Manager ACM in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Juniper Networks IDP ACM vulnerable to cross-site scripting
Overview Juniper Networks IDP ACM Appliance Configuration Manager contains a cross-site scripting vulnerability. Juniper Networks IDP ACM provides a web interface for changing configurations in the IDP. The ACM contains a cross-site scripting vulnerability. Taketo Ikeuchi of Hitachi Solutions, Lt...
CVE-2011-1411: Improper Authentication
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
CVE-2009-5086: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Appliance Configuration Manager ACM in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
JVN#44642341: Juniper Networks IDP ACM vulnerable to cross-site scripting
Juniper Networks IDP ACM provides a web interface for changing configurations in the IDP. The ACM contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the software Update to the latest version according to the...
CVE-2009-3300
The CVE-2009-3300 issue affects Shibboleth-related components: Identity Provider (IdP) and Service Provider (SP) in Shibboleth environments. Concrete details show multiple cross-site scripting (XSS) vulnerabilities that arise from redirect URLs appearing in automatically generated forms. Affected...
SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation
The Shibboleth authentication module provides user authentication and authorisation based on the Shibboleth Web Single Sign-on system. The module does not properly handle the changes of the underlying Shibboleth session. This can result in impersonation and possible privilege escalation if a user...