CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

CVE-2016-7467

The CVE-2016-7467 issue affects F5 BIG-IP APM when the TMM SSO plugin is used as a SAML IdP with an SP connector. A malformed, signed SAML authentication request from an authenticated user can disrupt traffic or trigger failover. Affected versions include BIG-IP APM 12.0.0–12.1.1, 11.6.0–11.6.1 H...

CVE-2016-7467

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...

Denial Of Service (DoS)

ruby-saml is vulnerable to denial of service DoS attacks. These attacks are possible because attackers can compress huge XML and pass it to the SAML endpoint. The deflate functio allows the attacker to achieve 1000:1 compression ratio which can be used to cause denial of service attacks...

Session Fixation Attacks

CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...

CVE-2017-4963: Session Fixation for UAA External Authentication | Cloud Foundry

Severity Low Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v252 and earlier versions UAA stand-alone release v2.0.0 – v2.7.4.12 & v3.0.0 – v3.11.0 UAA bosh release v26 & earlier versions Description UAA is vulnerable to session fixation when configured to authenticate...

python-pysaml2 XML External Entity Injection Vulnerability (CNVD-2017-05308)

PySAML2 is an implementation of SAML2 written in python. An XML external entity injection vulnerability exists in PySAML2 4.4.0 and earlier versions. A remote attacker can exploit this vulnerability to read arbitrary files by sending a specially crafted SAMPL XML request or response...

How to Configure NetScaler as IDP for SAML Based Integration with 15Five

This article describes how to configure NetScaler as an Identity Service Provider IDP for 15Five SaaS applications, using SAML Security Assertion Markup Language protocol. Introduction 15Five is a company that provides performance management platform that combines employee feedback, objectives...

Denial Of Service (DoS)

keycloak-saml-core is vulnerable to denial of service DoS attacks. The vulnerability exists due to the mishandling of a Logout request with an Extensions in the middle of the request...

NetIQ Access Manager Information Disclosure Vulnerability

NetIQ Access Manager provides a simple, secure, and scalable solution to handle all Web access needs. The SAML2 implementation of the Identity Server in NetIQ Access Manager fails to properly handle unsigned SAML requests, allowing an attacker to disclose the results to a potentially malicious...

F5 BIG-IP - TMM SSO plugin vulnerability CVE-2016-7467

Traffic may be disrupted or failover initiated when a malformed, signed SAML authentication request from an authenticated user is sent via SP connector on a BIG-IP configured as a SAML Identity Provider. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a...

Xxe

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

django-saml2-auth (>=1.0.2 <=1.1.4), django-saml2-auth-custom (>=1.0.0 <=1.0.4) +4 more potentially affected by CVE-2016-10149 via pysaml2 (>=4.0.2 <=4.4.0)

pysaml2 PYPI version =4.0.2, =1.0.2, =1.0.0, =12.0.2, =0.6.1, =3.4.8 Source cves: CVE-2016-10149 Source advisory: OSV:PYSEC-2017-25...

CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

PYSEC-2017-25

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

CVE-2016-10149

CVE-2016-10149 affects PySAML2 up to version 4.4.0, exposing an XML External Entity (XXE) vulnerability that allows a remote attacker to read arbitrary files via crafted SAML XML requests/responses. Root cause: improper XML processing/external-entity handling. Documented impact: read access to fi...

CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...

CVE-2016-10149

XML External Entity XXE vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML request or response...