Code injection

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...

CVE-2017-18909

Mattermost Server before 3.9.0 with SAML enabled is affected. The root cause is that encryption and signature verification are not mandatory in the SAML flow, which can weaken protection of SAML data. Affected product: Mattermost Server (pre-3.9.0). No explicit exploit details, mitigation steps, ...

CVE-2017-18909

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...

CVE-2018-21264

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response...

CVE-2018-21264

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response...

Code injection

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response...

CVE-2018-21264

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a SAML response...

CVE-2018-21264

Mattermost Server prior to 4.7.0, 4.6.2, and 4.5.2 has a vulnerability where the expiration date of a SAML response is not enforced. The connected documents do not provide further technical details, exploit information, or remediation steps. No additional impact or attack vector is described beyo...

CVE-2018-21263

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response...

CVE-2018-21263

Mattermost Server vulnerability CVE-2018-21263 affects versions prior to 4.7.0, 4.6.2, and 4.5.2. A crafted SAML response could allow an attacker to authenticate to another user’s account. Root cause details are not further provided in the documents. Impact is limited to authentication against a ...

CVE-2018-21263

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response...

Security Bulletin: Multiple vulnerabilities in WebSphere application server affect IBM Workload Scheduler

Summary There are multiple vulnerabilities in IBM WebSphere application server that may potentially affect IBM Workload Scheduler. Vulnerability Details CVEID: CVE-2018-1621 DESCRIPTION: IBM WebSphere Application Server could allow a local attacker to obtain clear text password in a trace file...

PT-2020-8464

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.7.3 Mattermost Server versions prior to 3.6.5 Description: An issue was discovered in Mattermost Server. A System Administrator can place a SAML certificate at an arbitrary pathname. Recommendations: For...

CVE-2020-5304

The dashboard in WhiteSource Application Vulnerability Management AVM before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data...

CVE-2020-5304

The dashboard in WhiteSource Application Vulnerability Management AVM before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data...

Code injection

The dashboard in WhiteSource Application Vulnerability Management AVM before version 20.4.1 allows Log Injection via a %0A%0D substring in the idp parameter to the /saml/login URI. This closes the current log and creates a new log with one line of data. The attacker can also insert malicious data...

CVE-2020-5304

CVE-2020-5304 affects WhiteSource Application Vulnerability Management (AVM) prior to version 20.4.1. The vulnerability allows log injection by sending a %0A%0D substring in the idp parameter to the /saml/login URI, which can close the current log and create a new log line with attacker-controlle...

GHSA-48RW-J489-928M Signature wrapping vulnerability in Spring Security

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an...

Signature wrapping vulnerability in Spring Security

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an...