fusionauth-samlv2

fusionauth-samlv2 هذا المستودع يوفّر ارتباطات SAML v2.0 بلغة Java باستخدام JAXB. ستستخدم هذه المكتبة لمعالجة طلبات واستجابات SAML. راجع الاختبارات للحصول على أمثلة على الكود. الإفصاحات الأمنية إذا وجدت ثغرة أمنية أو خطأ آخر متعلقًا بالأمان، يرجى الإبلاغ عن الثغرة هنا قبل فتح issue على GitHub. سيس...

SAML Implementation Vulnerability Impacting Some Akamai Services

This blog post provides an overview of a vulnerability discovered in Akamai's Enterprise Application Access EAA product which has been patched. This vulnerability could have allowed an actor to impersonate an authorized user when interacting with an application that used Security Assertion Markup...

CVE-2021-27736

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...

FusionAuth fusionauth-samlv2 代码问题漏洞

fusionauth fusionauth-samlv2 is a personal developer of a JAVA library that provides JAXB functionality . The library can mainly handle SAML requests and replies for scenarios such as single sign-on. A security vulnerability exists in FusionAuth fusionauth-samlv2 versions prior to 0.5.4 that allo...

PT-2021-17618

Name of the Vulnerable Software and Affected Versions: FusionAuth fusionauth-samlv2 versions prior to 0.5.4 Description: The issue allows XXE attacks via a forged AuthnRequest or LogoutRequest because the parseFromBytes function uses javax.xml.parsers.DocumentBuilderFactory unsafely. This can be...

CVE-2021-27736: Improper Restriction of XML External Entity Reference

FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely...

Authentication flaw

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...

CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 is vulnerable to a Signature Exclusion Attack: remote attackers can forge SAML messages and bypass authentication when a SAML assertion lacks a Signature element. The Red Hat/Red Hat advisory and other connected sources confirm the affected version and behavior....

PT-2020-13197

Name of the Vulnerable Software and Affected Versions FusionAuth fusionauth-samlv2 version 0.2.3 Description The issue allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, also known as a "Signature exclusion attack"...

FusionAuth-SAMLv2 0.2.3 Message Forging

COMPASS SECURITY ADVISORY https://www.compass-security.com/research/advisories/ Product: SAML v2.0 bindings in Java using JAXB Vendor: FusionAuth CSNC ID: CSNC-2020-002 CVE ID: CVE-2020-12676 Subject: Signature Exclusion Attack Risk: High Effect: Remotely exploitable Author: Felix Sieges Date:...

CVE-2020-12676: Improper Verification of Cryptographic Signature

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack"...