CVE-2019-10201

Keycloak SAML broker (versions up to 6.0.1) is affected by CVE-2019-10201. The issue is that the broker did not verify the existence of signatures on SAML responses, so an attacker could modify a SAML Response (e.g., remove elements) and still have it accepted, enabling impersonation and access ...

CVE-2019-10201

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...

keycloak: SAML broker does not check existence of signature on document allowing any user impersonation

It was found that Keycloak's SAML broker did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.3.3 security update

A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

APSB19-42 Security update available for Adobe Experience Manager

Adobe has released security updates for Adobe Experience Manager AEM. These updates resolve a critical authentication bypass vulnerability in the Security Assertion Markup Language SAML handler in AEM versions 6.4 and 6.5. Successful exploitation could result in unauthorized access to the AEM...

Workspace App for Linux 1906 giving “Unacceptable TLS Certificate” error

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. With the Citrix Workspace App for Linux 1906 and above, if you are using a SAML store with AuthV3, a...

Oracle Linux 8 : mod_auth_mellon (ELSA-2019-0985)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2019-0985 advisory. 0.14.0-3.2 - Resolves: rhbz1696197 - CVE-2019-3878 modauthmellon: authentication bypass in ECP flow rhel-8.0.0.z Tenable has extracted the preceding description...

NewStart CGSL CORE 5.04 / MAIN 5.04 : mod_auth_mellon Multiple Vulnerabilities (NS-SA-2019-0077)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has modauthmellon packages installed that are affected by multiple vulnerabilities: - A vulnerability was found in modauthmellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass throug...

CVE-2018-20857

Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a nameid node with [email protected] followed by . and then the attacker's domain name...

CVE-2018-20857

Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a nameid node with [email protected] followed by . and then the attacker's domain name...

SAML Authentication Bypass

samlr is vulnerable to authentication bypass attacks. This is due to inconsistent validation of signed assertions which allows an attacker to manipulate SAML data without invalidating the cryptographic signature and bypass authentication to SAML service providers...

CVE-2019-1006

An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'...

CVE-2019-1006

An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'...

Authentication flaw

An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'...

CVE-2019-1006

An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'...

CVE-2019-1006

CVE-2019-1006 corresponds to an authentication bypass vulnerability in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF) that allows signing SAML tokens with arbitrary symmetric keys. The connected Nessus entries reiterate this issue as part of Microsoft SharePoint serv...

Microsoft SharePoint Foundation 2013 WCF/WIF SAML Authentication Bypass Vulnerability (KB4475527)

This host is missing an important security update according to Microsoft KB4475527 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Microsoft .NET Framework Multiple Vulnerabilities (KB4507420)

This host is missing a critical security update according to Microsoft KB4507420 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft .NET Framework Multiple Vulnerabilities (KB4506991)

This host is missing a critical security update according to Microsoft KB4506991 Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This progra...

Microsoft SharePoint Enterprise Server 2016 Multiple Vulnerabilities (KB4475520)

This host is missing an important security update according to Microsoft KB4475520 SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...