4917 matches found
CVE-2024-30264
Typebot is an open-source chatbot builder. A reflected cross-site scripting XSS in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the...
CVE-2024-41657
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...
CVE-2024-41730
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confidentiality, integrity and availabilit...
CVE-2024-23356
Memory corruption during session sign renewal request calls in HLOS...
CVE-2024-23480
A fallback mechanism in code sign checking on macOS may allow arbitrary code execution. This issue affects Zscaler Client Connector on MacOS prior to 4.2...
CVE-2024-10111
The OAuth Single Sign On – SSO OAuth Client plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers...
CVE-2024-24848
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a...
CVE-2024-4228
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection', CWE - 200 - Exposure of Sensitive Information to an Unauthorized Actor, CWE - 522 - Insufficiently Protected Credentials vulnerability in Magarsus Consultancy SSO Single Sign On allows SQL Injection. This issue...
MAL-2025-1068 Malicious code in browser-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6d411988c71278a3b1cc021357c555ec43f75d6834289977b60fb08c1ce8d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in custom-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59f7b65e1e7c3a5681f3302cca12603566d8b1d18e7b9a4803632415f935f0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in browser-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6d411988c71278a3b1cc021357c555ec43f75d6834289977b60fb08c1ce8d19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1105 Malicious code in custom-sign-in (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59f7b65e1e7c3a5681f3302cca12603566d8b1d18e7b9a4803632415f935f0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-24749
Cross-Site Request Forgery CSRF vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On SSO allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On SSO: from n/a through 1.2.5...
CVE-2025-24749
CVE-2025-24749 affects the WordPress plugin EZPZ SAML SP Single Sign On (SSO) for versions 1.2.5 and earlier. The provided documents describe a CSRF vulnerability in this plugin, with PatchStack and CVE listings also noting a CSRF to Stored XSS vector. Root cause details are not explicitly enumer...
[SECURITY] Fedora 40 Update: lemonldap-ng-2.20.2-1.fc40
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
CVE-2025-24749: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On SSO allows Cross Site Request Forgery. This issue affects EZPZ SAML SP Single Sign On SSO: from n/a through 1.2.5...
WordPress plugin EZPZ SAML SP Single Sign On 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
January 28, 2025—KB5050094 (OS Build 26100.3037) Preview
None None...
[SECURITY] Fedora 40 Update: freeipa-4.12.2-3.fc40
IPA is an integrated solution to provide centrally managed Identity users, hosts, services, Authentication SSO, 2FA, and Authorization host access control, SELinux user roles, services. The solution provides features for further integration with Linux based clients SUDO, automount and integration...