3350 matches found
CVE-2011-3707
JanRain PHP OpenID library aka php-openid 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files...
CVE-2011-3707
JanRain PHP OpenID library aka php-openid 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files...
PT-2011-4597
Name of the Vulnerable Software and Affected Versions JanRain PHP OpenID library aka php-openid version 2.2.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message,...
CVE-2011-3707: Exposure of Sensitive Information to an Unauthorized Actor
JanRain PHP OpenID library aka php-openid 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files...
CVE-2009-5085
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...
Design/Logic Flaw
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...
CVE-2009-5083
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...
CVE-2008-7299
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field...
Authentication flaw
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...
CVE-2009-5083
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...
Design/Logic Flaw
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field...
CVE-2009-5085
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...
CVE-2009-5083
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...
CVE-2008-7299
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field...
CVE-2008-7299
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 is vulnerable to a spoofing issue in its SAML 1.x browser-artifact handling. The root cause is an incomplete browser-artifact mechanism that enables remote OpenID providers to spoof assertions via the Issuer field, affecting TFIM versions prior t...
PT-2011-1332
Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager TFIM versions 6.2.0 through 6.2.0.1 Description The issue concerns the authentication process when IBM Tivoli Federated Identity Manager TFIM is configured as an OpenID relying party. It fails to reject...
PT-2011-1334
Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager TFIM versions 6.2.0 through 6.2.0.1 Description The issue allows user-assisted remote attackers to bypass intended trust restrictions. This occurs when the software, configured as an OpenID provider, fails...
CVE-2009-5085: Undefined Security Weakness
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...
CVE-2009-5083: Improper Authentication
IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...
PT-2011-1291
Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager TFIM version 6.2.0 Description The issue is related to an incomplete SAML 1.x browser-artifact in IBM Tivoli Federated Identity Manager TFIM, which allows remote OpenID providers to spoof assertions. This ...