CVE-2021-37843

The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known i.e., no other authentication is provided. The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6....

Authentication flaw

The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known i.e., no other authentication is provided. The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6....

CVE-2021-37843

The resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the username is known i.e., no other authentication is provided. The fixed versions are for Jira: 3.6.6.1, 4.0.12, 5.0.5; for Confluence 3.6.6, 4.0.12, 5.0.5; for Bitbucket 2.5.9, 3.6....

CVE-2021-37843

The CVE-2021-37843 issue affects Atlassian SAML SSO apps and allows a remote attacker to login to a user account knowing only the username (no additional authentication). Fixed versions include Jira: 3.6.6.1, 4.0.12, 5.0.5; Confluence: 3.6.6, 4.0.12, 5.0.5; Bitbucket: 2.5.9, 3.6.6, 4.0.12, 5.0.5;...

Important: Red Hat Security Advisory: lasso security update

An update for lasso is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

SUSE-SU-2021:2589-1 Security update for lasso

This update for lasso fixes the following issues: - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses. bsc1186768...

How to Configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider

This article describes how to configure Office365 for Single Sign-on with NetScaler as SAML Identity Provider and this article also provides detailed steps to configure Windows Azure to use NetScaler as a Security Token Service STS/ Identity Provider IDP...

Citrix Application Delivery Controller安全漏洞

Citrix Systems Citrix ADC and NetScaler Gateway is an application delivery controller from Citrix Systems, Inc. A security vulnerability exists in Citrix ADC and NetScaler Gateway that could allow an attacker to steal valid user sessions via SAML authentication hijacking, which could lead to a...

openSUSE: Security Advisory for lasso (openSUSE-SU-2021:1057-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for lasso (important)

openSUSE Security Update: Security update for lasso Announcement ID: openSUSE-SU-2021:1057-1 Rating: important References: 1186768 Cross-References: CVE-2021-28091 CVSS scores: CVE-2021-28091 NVD : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2021-28091 SUSE: 8.8...

OPENSUSE-SU-2021:1057-1 Security update for lasso

This update for lasso fixes the following issues: - CVE-2021-28091: Fixed XML signature wrapping vulnerability when parsing SAML responses boo1186768...

Citrix Application Delivery Controller, Citrix Gateway, and Citrix SD-WAN WANOP Edition appliance Security Update

Multiple vulnerabilities have been discovered in Citrix ADCformerlyknown asNetScaler ADCandCitrix Gateway formerlyknown asNetScaler Gateway,and Citrix SD-WAN WANOP Edition models 4000-WO, 4100-WO, 5000-WO, and 5100-WO.These vulnerabilities,if exploited,could result in the following security issue...

Debian: Security Advisory (DLA-2707-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2707-1 : sogo - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2707 advisory. - SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deploymen...

[SECURITY] [DLA 2707-1] sogo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2707-1 [email protected] https://www.debian.org/lts/security/ Anton Gladky July 12, 2021 https://wiki.debian.org/LTS -...

Advisory ROSA-SA-2021-1921

Software: modauthmellon 0.14.0 OS: Cobalt 7.9 CVE-ID: CVE-2019-3878 CVE-Crit: HIGH CVE-DESC: A vulnerability was discovered in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy server and modauthmellon is configured to allow only authenticated users with the require...

U.S. Dept Of Defense: XSS DUE TO CVE-2020-3580

Hello Team, During my research, I found the following host to be vulnerable to CVE 2020-3580 which is POST BASED XSS. Vulnerable URL: https://█████/+CSCOE+/saml/sp/acs?tgname=a Impact Attackers can steal cookies and even takeover accounts and perform different malicious activities. System Hosts █...

U.S. Dept Of Defense: ███████ - XSS - CVE-2020-3580

████ appears to be affected by the Cisco ASA XSS CVE-2020-3580, This vulnerablity is targets the saml service within the VPN. It is triggered via a POST request to /+CSCOE+/saml/sp/acs?tgname=a References...

EUVD-2021-1260

XML Processing error in github.com/crewjam/saml...

XML Processing error in github.com/crewjam/saml

Impact There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed...