CVE-2018-6519

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp...

CVE-2018-6519

The vulnerability CVE-2018-6519 affects SimpleSAMLphp’s SAML2 library: Regular Expression Denial of Service for fraction-of-seconds in timestamps. Affected versions are SimpleSAMLphp SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1. Impact is partial availability (DoS) via netw...

CVE-2018-6519

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp...

EulerOS 2.0 SP2 : ipsilon (EulerOS-SA-2018-1013)

According to the version of the ipsilon packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A vulnerability was found in ipsilon in the SAML2 provider's handling of sessions. An attacker able to hit the logout URL could determine what...

Samlify and Express-saml2 Arbitrary User Impersonation Vulnerability

Samlify is an open source Node.js API for single sign-on. express-saml2 is the predecessor of Samlify. A security vulnerability exists in Samlify 2.2.0 and earlier versions and Express-saml2. An attacker can exploit this vulnerability to impersonate any user...

CVE-2017-1000452

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

Design/Logic Flaw

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

CVE-2017-1000452

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

CVE-2017-1000452

CVE-2017-1000452 affects Samlify (≤2.2.0) and the predecessor Express-saml2. It describes an XML Signature Wrapping vulnerability that could allow an attacker to impersonate arbitrary users. Reported impact includes high confidentiality, integrity, and availability concerns; exploitation is descr...

CVE-2017-1000452

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

GHSA-7FPW-CFC4-3P2C Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

Auth0 passport-wsfed-saml2 elevation of privilege vulnerability

Auth0 passport-wsfed-saml2 library is a set of Auth0 development platform of the United States Auth0 company's tool library . A security vulnerability exists in Auth0 passport-wsfed-saml2 library versions prior to 3.0.5. An attacker can exploit the vulnerability to spoof other users and potential...

CVE-2017-16897

The CVE pertains to the Auth0 passport-wsfed-saml2 library prior to version 3.0.5. The vulnerability allows an attacker to impersonate another user and potentially elevate privileges if the SAML identity provider signs only the Assertion (not the full SAML response). This root cause involves inco...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

aai-logon.ethz.ch XSS vulnerability

Vulnerable URL: https://aai-logon.ethz.ch/idp/profile/SAML2/Redirect/SSO;jsessionid=2FF9710C0F995FE721A8667567733053?execution=e1s2"'--!alert/Y4R4G/...

XML External Entity Processing (XXE)

simplesamlphp/saml2 is vulnerable to XML external entity processing XXE attacks. The attacks are possible because it does not use SAML2DOMDocumentFactory to create DOMDocuments from a string containing XML and does not call libxmldisableentityloader before calling any code...

Denial Of Service (DoS)

simplesamlphp/saml2 is vulnerable to denial of service DoS attacks and spoofed SAML responses. It mishandles the conversion of return values to boolean which allows attackers to perform these attacks...

Design/Logic Flaw

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active...