SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-006

This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configured to allow visitors to register for user accounts but administrator approval is required, the module doesn't sufficiently enforce the administrative approval requirement, in the...

Rocket.Chat: SAML authentication bypass

Summary When using SAML authentication, responses are not checked properly. This allows attacker to inject/modify any assertions in the SAML response and thus, for example, authenticate as administrator. Description Following code snippets are from app/meteor-accounts-saml/server/samlutils.js Whe...

[SECURITY] [DLA 2119-1] python-pysaml2 security update

Package : python-pysaml2 Version : 2.0.0-1+deb8u3 CVE ID : CVE-2020-5390 Debian Bug : 949322 It was discovered that pysaml2, a Python implementation of SAML to be used in a WSGI environment, was susceptible to XML signature wrapping attacks, which could result in a bypass of signature verificatio...

USN-4291-1: mod-auth-mellon vulnerability

It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL...

SimpleSAMLphp Log Message Disclosure Vulnerability

SimpleSAMLphp is a PHP authentication application that implements the SAML 2.0 Service Provider and Identity Provider features. A log information disclosure vulnerability exists in SimpleSAMLphp. The vulnerability originates from the abnormal output of log files from a web system or product. An...

Harnessing the power of identity management (IDaaS) in the cloud

Sometimes, consumers have it easy. Take, for example, when they accidentally lock themselves out of their personal email. Their solution? Reset the password. With one click, they're able to change their old, complicated password with a new, more memorable one. Self-service password reset is aweso...

CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

Cross site scripting

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

CVE-2020-6850

CVE-2020-6850 affects the WordPress plugin Miniorange SAML SP SSO (miniorange-saml-20-single-sign-on)

CVE-2020-6850

Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element...

ShareFile Enterprise - UMT is unable to sync new users created in AD

The user is trying to create an Admin service account that's not leveraging SAML authentication. However, the account is not syncing within the UMT console...

CVE-2020-6181

Under some circumstances the SAML SSO implementation in the SAP NetWeaver SAPBASIS versions 702, 730, 731, 740 and SAP ABAP Platform SAPBASIS versions 750, 751, 752, 753, 754, allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response...

Design/Logic Flaw

Under some circumstances the SAML SSO implementation in the SAP NetWeaver SAPBASIS versions 702, 730, 731, 740 and SAP ABAP Platform SAPBASIS versions 750, 751, 752, 753, 754, allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response...

CVE-2020-6181

Under some circumstances the SAML SSO implementation in the SAP NetWeaver SAPBASIS versions 702, 730, 731, 740 and SAP ABAP Platform SAPBASIS versions 750, 751, 752, 753, 754, allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response...

CVE-2020-6181

CVE-2020-6181 affects SAP NetWeaver SAP_BASIS (702, 730, 731, 740) and SAP ABAP Platform SAP_BASIS (750–754). The SAML SSO implementation may include invalidated data in HTTP response headers, enabling HTTP Response Splitting. Impact is a header-level manipulation in Web users; exact exploit deta...

Security Bulletin: Security Vulnerabilities have been Identified in Websphere Application Server Shipped with Predictive Customer Intelligence (CVE-2012-5783, CVE-2018-1614, CVE-2014-0114, CVE-2015-0899)

Summary Websphere Application Server is shipped with Predictive Customer Intelligence. Information about security vulnerabilities affecting Websphere Application Server has been published in security bulletins. Vulnerability Details Please consult the security bulletins: Security Bulletin:...

CVE-2019-15585

Improper authentication exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account...

CVE-2019-15585

Improper authentication exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account...

CVE-2019-15585

Improper authentication exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account...

Authentication flaw

Improper authentication exists in 12.3.2, 12.2.6, and 12.1.12 for GitLab Community Edition CE and Enterprise Edition EE in the GitLab SAML integration had a validation issue that permitted an attacker to takeover another user's account...