XML Signature Wrapping

Samlify and express-saml2 are vulnerable to XML signature wrapping attacks. Attackers who observe SAML responses are able to add NameID's to the response without breaking the signature check. This could allow them to login as any user...

GHSA-7FPW-CFC4-3P2C Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

Elevation Of Privileges

passport-wsfed-saml2 is vulnerable to elevation of privileges. When a SAML identity provider doesn't sign the entire SAML response, attackers can change the NameIdentifier to login as a different user. The attacker needs either be able to intercept encrypted traffic and modify SAML responses on t...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

Design/Logic Flaw

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

The CVE pertains to the Auth0 passport-wsfed-saml2 library prior to version 3.0.5. The vulnerability allows an attacker to impersonate another user and potentially elevate privileges if the SAML identity provider signs only the Assertion (not the full SAML response). This root cause involves inco...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

TIBCO tibbr Multiple Vulnerabilities

TIBCO tibbr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tibco:tibbr"; if description...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

Code injection

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530 SAML protocol handling errors in tibbr

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

CVE-2017-5530

CVE-2017-5530 affects the tibbr web server components in Tibco tibbr Community (5.2.1 and below; 6.0.0/6.0.1; 7.0.0) and tibbr Enterprise (same version range). The issue arises from SAML protocol handling errors that may allow authorized users to impersonate other users and escalate privileges. C...

CVE-2017-5530: Undefined Security Weakness

The tibbr web server components of tibbr Community, and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users, and therefore escalate their access privileges. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0,...

Fedora 25 : mrbs (2017-b5bcfedf10)

Changes since MRBS 1.6.1 : - Fixed a number of security issues in MRBS that were disclosed to the project by SySS GmbH, including XSS, CSRF protection and session fixation. - Improved behaviour of browser caching in MRBS. - Improved localisation, especially the use of colons in labels. - Added ne...

TIBCO Security Advisory: December 12, 2017 - tibbr -2017-5530

SAML protocol handling errors in tibbr Original release date: December 12, 2017 Last revised:-- CVE-2017-5530 Source: TIBCO SoftwareInc. SAML protocol handling errors in tibbr Original release date: December 12, 2017 Last revised: -- Source: TIBCO Software Inc. Systems Affected tibbr Community...

TIBCO Security Advisory: December 12, 2017 - tibbr -2017-5530

SAML protocol handling errors in tibbr Original release date: December 12, 2017 Last revised:-- CVE-2017-5530 Source: TIBCO SoftwareInc. SAML protocol handling errors in tibbr Original release date: December 12, 2017 Last revised: -- Source: TIBCO Software Inc. Systems Affected tibbr Community...

REST API - Improved HTTP Authentication

h4. Suggestion Description Confluence Server REST API|https://developer.atlassian.com/confdev/confluence-server-rest-api is a simple resource that help administrators to perform operations that would take some time of their day to day activities in a couple seconds, instead of a couple minutes. I...