CVE-2012-5351

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

Authentication flaw

Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."...

Authentication flaw

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

Authentication flaw

Java Open Single Sign-On Project Home JOSSO allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."...

CVE-2012-5352

The CVE-2012-5352 entry concerns the Java Open Single Sign-On Project Home (JOSSO). It describes a vulnerability where remote attackers can forge SAML messages and bypass authentication if the SAML assertion lacks a Signature element (a “Signature exclusion attack”). The consequence is partial di...

CVE-2012-5351

CVE-2012-5351 affects Apache Axis2 and allows remote attackers to bypass authentication by forging a SAML assertion that lacks a Signature element (Signature exclusion attack). This is the same family as CVE-2012-4418 and enables message forgery without proper XML-signature verification. IBM-rela...

CVE-2012-5353

CVE-2012-5353 affects Eduserv OpenAthens SP 2.0 for Java. The vulnerability arises when a SAML assertion lacks a Signature element, enabling remote attackers to forge messages and bypass authentication (a “Signature exclusion attack”). The issue is documented across multiple sources (NVD entry an...

CVE-2012-5351

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418...

CVE-2012-5352

Java Open Single Sign-On Project Home JOSSO allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."...

CVE-2012-5353

Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."...

CVE-2012-3314

IBM Tivoli Federated Identity Manager TFIM and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages 1 a signature-validation bypass for SAML messages containing unsigned elements,...

Input validation

IBM Tivoli Federated Identity Manager TFIM and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages 1 a signature-validation bypass for SAML messages containing unsigned elements,...

CVE-2012-3314

CVE-2012-3314 affects IBM Tivoli Federated Identity Manager (TFIM) and TFIM Business Gateway (TFIMBG) versions 6.1.1, 6.2.0, 6.2.1, and 6.2.2. The IBM advisories describe three related issues that can lead to a crafted message being accepted and a session created, enabling an attacker to imperson...

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

Default configuration

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username...

CVE-2012-2351

The vulnerability CVE-2012-2351 affects Mahara’s auth/saml plugin. In Mahara versions older than 1.4.2, the default setting for “Match username attribute to Remote username” is false, enabling a remote SAML IdP to spoof users on other IdPs by reusing the same internal username. This is a configur...

Debian: Security Advisory (DSA-2467-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-2467-1 : mahara - insecure defaults

It was discovered that Mahara, the portfolio, weblog, and resume builder, had an insecure default with regards to SAML-based authentication used with more than one SAML identity provider. Someone with control over one IdP could impersonate users from other IdP's. %NASLMINLEVEL 70300 C Tenable...