3937 matches found
U.S. Dept Of Defense: ███████ - XSS - CVE-2020-3580
████ appears to be affected by the Cisco ASA XSS CVE-2020-3580, This vulnerablity is targets the saml service within the VPN. It is triggered via a POST request to /+CSCOE+/saml/sp/acs?tgname=a References...
EUVD-2021-1260
XML Processing error in github.com/crewjam/saml...
GHSA-4HQ8-GMXX-H6W9 XML Processing error in github.com/crewjam/saml
Impact There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed...
XML Processing error in github.com/crewjam/saml
Impact There are three vulnerabilities in the go encoding/xml package that can allow an attacker to forge part of a signed XML document. For details on this vulnerability see xml-roundtrip-validator Patches In version 0.4.3, all XML input is validated prior to being parsed...
GHSA-433W-MM6H-RV9P Auth bypass in SAML provider
Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider: - goxmldsig - Signature Validation Bypass - gosaml2 - Authentication Bypass Patches Patch available Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90...
Auth bypass in SAML provider
Impact The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider: - goxmldsig - Signature Validation Bypass - gosaml2 - Authentication Bypass Patches Patch available Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90...
Authentication Bypass in tyk-identity-broker
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip encoding/decoding XML data...
GHSA-599H-8WPJ-75XJ Authentication Bypass in tyk-identity-broker
The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip encoding/decoding XML data...
Important: lasso
Issue Overview: An XML Signature Wrapping XSW vulnerability was found in Lasso. This flaw allows an attacker to modify a valid SAML response to include an unsigned SAML assertion, which may be used to impersonate another valid user recognized by the service using Lasso. The highest threat from th...
Citrix ADC and Citrix NetScaler Gateway Multiple Vulnerabilities (CTX297155)
The remote Citrix ADC or Citrix NetScaler Gateway device is version 11.1.x prior to 11.1-65.20, 12.1.x prior to 12.1-62.23, 12.1-FIPS prior to 12.1-55.238 or 13.0.x prior to 13.0-82.41. It is, therefore, affected by multiple vulnerabilities: - Network-based denial-of-service from within the same...
Fedora: Security Advisory for lasso (FEDORA-2021-508acb1153)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for lasso (FEDORA-2021-bb3ea1e191)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2020-8300
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway mus...
Improper access control
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway mus...
CVE-2020-8300
CVE-2020-8300 affects Citrix ADC and Citrix NetScaler Gateway (multiple versions) and enables SAML authentication hijack via phishing to steal a valid user session when the appliance is configured as a SAML SP or IdP. Affected versions include 13.0-82.41, 12.1-62.23, 11.1-65.20 and 12.1-FIPS befo...
CVE-2020-8300
Citrix ADC and Citrix/NetScaler Gateway before 13.0-82.41, 12.1-62.23, 11.1-65.20 and Citrix ADC 12.1-FIPS before 12.1-55.238 suffer from improper access control allowing SAML authentication hijack through a phishing attack to steal a valid user session. Note that Citrix ADC or Citrix Gateway mus...
PT-2021-12729 · Citrix · Citrix Netscaler Gateway +1
Name of the Vulnerable Software and Affected Versions: Citrix ADC and Citrix/NetScaler Gateway versions prior to 13.0-82.41 Citrix ADC and Citrix/NetScaler Gateway versions prior to 12.1-62.23 Citrix ADC and Citrix/NetScaler Gateway versions prior to 11.1-65.20 Citrix ADC 12.1-FIPS versions prior...
Exploit for Improper Access Control in Citrix Gateway
Detect Citrix ADC SAML action or SAML iDP Profile config vulnera...
IBM WebSphere Application Server Elevation of Privilege Vulnerability (CNVD-2021-42146)
IBM WebSphere Application Server WAS is an application server product from IBM in the United States. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A security vulnerability exists in WebSphere Application Server tha...