4940 matches found
GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access
GitHub has released security updates for Enterprise Server GHES to address multiple issues, including a critical bug that could allow unauthorized access to an instance. The vulnerability, tracked as CVE-2024-9487, carries a CVS score of 9.5 out of a maximum of 10.0 "An attacker could bypass SAML...
CVE-2024-9487
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be...
CVE-2024-47832
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers...
CVE-2024-47832
CVE-2024-47832 affects ssoready (SSOReady) when self-hosted as a Docker-based IDP. The issue is an XML signature bypass caused by differing XML parser behaviors, enabling signature bypass if an attacker can access certain IDP-signed messages. Public hosted instance (https://ssoready.com) is unaff...
CVE-2024-47832 XML Signature Bypass via differential XML parsing in ssoready
ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers...
SSOReady 数据伪造问题漏洞
SSOReady is an open source development tool for enterprise SSO from SSOReady Open Source. A data forgery vulnerability exists in SSOReady, which stems from the vulnerability of the affected version to XML signature bypass attacks...
CVE-2024-9412: Placement of User into Incorrect Group
An improper authorization vulnerability exists in the Rockwell Automation affected products that could allow an unauthorized user to sign in. While removal of all role mappings is unlikely, it could occur in the case of unexpected or accidental removal by the administrator. If exploited, an...
Okta Fixes Critical Vulnerability Allowing Sign-On Policy Bypass
Okta fixed a vulnerability in its Classic product that allowed attackers to bypass sign-on policies. Exploitation required valid…...
CVE-2024-41593
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...
CVE-2024-41593: Out-of-bounds Write
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ftpayloaddns, because a byte sign-extension operation occurs for the length argument of a memcpy call, leading to a heap-based Buffer Overflow...
CVE-2024-41593
CVE-2024-41593 affects DrayTek Vigor310 devices up to version 4.3.2.6. The vulnerability is a heap-based buffer overflow in the web interface function ft_payload_dns due to a byte sign-extension in the length argument of a memcpy call, enabling remote code execution. Connected sources confirm the...
go-toolset:ol8 security update
delve golang 1.21.13-3 - Add evp-digest-sign-final.patch - Resolves: RHEL-61109 go-toolset...
RHSA-2024:6880 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 9
Bulletin has no description...
RHSA-2024:6879 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 8
Bulletin has no description...
RHSA-2024:6878 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.11 security update on RHEL 7
Bulletin has no description...
RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
Bulletin has no description...
RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8
Bulletin has no description...
RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
Bulletin has no description...