CVE-2021-3034

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on SSO integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the...

Red Hat Single Sign-On 7安全漏洞

Red Hat Single Sign-On 7 is a Web single sign-on and identity federation based on the Saml 2.0, OpenId Connect, and Oauth 2.0 specifications from Red Hat USA. A security vulnerability exists in Red Hat Single Sign-On 7 that allows attacks that emulate a user's internationalized domain name IDN...

CVE-2020-5148

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewal...

SonicWall SSO-agent 授权问题漏洞

SonicWall SSO-agent is a software application from SonicWall, Inc. SonicWall SSO-agent is a software application from SonicWall, Inc. that provides a single login to provide access to multiple network resources based on administrator-configured group membership and policy matching. A security...

How to Force Connections Through NetScaler Gateway Using Optimal Gateway Feature of StoreFront

This article describes how to use the Optimal Gateway setting available in StoreFront to force applications to launch through NetScaler Gateway. It applies when accessing StoreFront through Citrix Receiver to connect to NetScaler Gateway virtual server and launching resources from XenApp/XenDeskt...

argo-cd 跨站脚本漏洞

GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. github.com/argoproj/argo-cd/cmd A cross-site scripting vulnerability exists, which stems from the fact that SSO providers connecting to Argo CD will have to send malicious error...

February 24, 2021—KB4601382 (OS Builds 19041.844 and 19042.844) Preview

None None...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On January 2021 CPU

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

note-mark

Note Mark !License: AGPL V3https://img.shields.io/github/li...

Troubleshooting Citrix Pass-Through Authentication

This article outlines workarounds and resolutions to specific Citrix pass-through authentication issues. Common Pass-Through Authentication Issues and Inquiries Refer to the following links for information on common pass-through authentication issues and inquiries: Citrix Docs - Enabling...

CVE-2021-21310 Token verification bug in next-auth

NextAuth.js next-auth is am open source authentication solution for Next.js applications. In next-auth before version 3.3.0 there is a token verification vulnerability. Implementations using the Prisma database adapter in conjunction with the Email provider are impacted. Implementations using the...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

Cross site request forgery (csrf)

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

Keycloak is affected by CVE-2020-10734 due to missing CSRF protection on the OIDC logout endpoint. The vulnerability is described across multiple sources as affecting Keycloak implementations used with Red Hat Fuse 7, Red Hat SSO 7, and Red Hat OpenShift Application Runtimes, with the OIDC logout...

CVE-2020-10734: Cross-Site Request Forgery (CSRF)

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

ZCFees Number Error Vulnerability

A Numeric Error vulnerability exists in ZCFees that arises from a network system or product not properly calculating or converting resulting numbers. An attacker could exploit this vulnerability to cause, among other things, an integer overflow or a sign error...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header 'Accept:...

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

The plugin had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email address. PoC The plugin must have a valid purchase code for the request to work curl -X GET --header 'Content-Type: application/json' --header...