New Google Drive Phishing Scam Uncovered

Phishers have again leveraged users’ trust in Google with a newly discovered campaign designed to steal credentials that grant access to the multitude of Google’s online services. New phishing pages hosted on Google Drive were discovered by researcher Aditya K. Sood of Elastica Cloud Threat Labs...

Zendesk: Security Missconfiguration in Autologin

Here I am addressing Critical misconfiguration in autologin feature 1. Open the link in the browser https://dashboard.zopim.com/home and enter your username and password and don't tick select the option Always sign in automatically and login 2. now logout from your account 3. now you logged out...

Oracle Access Manager Multiple Vulnerabilities (July 2015 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple vulnerabilities : - An unspecified flaw exists in the Configuration Service subcomponent that allows a remote, authenticated attacker to impact confidentiality and integrity. CVE-2015-2593 - An unspecified...

You Can Now Use Messenger App without a Facebook Account

Don't have Facebook account but want to use its Messenger service? Then go for it because Mark Zuckerberg wants even the people who hate Facebook to use the social network's separate Messenger service. So, you no longer need an active Facebook account to make use of the Messenger service, all you...

Linux kernel OZWPAN driver denial of service vulnerability (CNVD-2015-03714)

Linux kernel is an open source operating system.OZWPAN is one of the drivers for receiving, parsing and forwarding network packets. An integer sign error vulnerability exists in the 'ozhcdgetdesccnf' function in the drivers/staging/ozwpan/ozhcd.c file of the Linux kernel OZWPAN driver, which allo...

Design/Logic Flaw

IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation RDNG 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management RM session upon LTPA token...

Fortinet Single Sign On Hello Message Multiple Vulnerabilities (CVE-2015-2281)

Multiple Vulnerabilities exists in Fortinet Single Sign On FSSO. The vulnerabilities are due to a lack of adequate validation of user supplied input when processing HELLO messages. A remote, unauthenticated attacker could exploit these vulnerabilities by sending a specially crafted HELLO message ...

[SECURITY] Fedora 22 Update: lasso-2.4.1-3.fc22

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

Shopify: XSS in experts.shopify.com

Hi, XSS vulnerability in experts.shopify.com, Steps to verify: 1. Go to https://experts.shopify.com 2. Sign up for an expert. Please do note that you must create a new account if you already have, do not use existing account or an account that did not yet apply for an expert then you will ask to...

[SECURITY] Fedora 20 Update: lasso-2.4.1-1.fc20

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

SAP EMR Unwired and Clinical Task Tracker Access Restriction Bypass Vulnerabilities

SAP EMR Unwired is a mobile app that enables physicians and nurses to instantly access patient data when they need it.SAP Clinical Task Tracker is an easy and secure way to access clinical tasks assigned to your patients anytime, anywhere. SAP EMR Unwired and Clinical Task Tracker fail to properl...

Fortinet Single Sign On collectoragent.exe stack buffer overflow vulnerability

Fortinet Single Sign On FSSO is a single sign-on solution for Fortinet devices. A stack buffer overflow vulnerability in collectoragent.exe in versions prior to Fortinet Single Sign On FSSO build 164 allows remote attackers to send a specially crafted PROCESSHELLO message to TCP port 8000 to...

Fortinet Single Sign On Stack Overflow Exploit

Exploit for windows platform in category dos / poc 1. Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-...

CVE-2015-2281

Fortinet Single Sign On (FSSO) collectoragent.exe is affected by a stack-based buffer overflow in the Message Dispatcher when processing a PROCESS_HELLO message. This vulnerable path exists in FSSO builds preceding 164 and allows remote, unauthenticated attackers to execute arbitrary code via a c...

[CORE-2015-0006] - Fortinet Single Sign On Stack Overflow

Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors contacted: Fortinet Release mode:...

Fortinet Single Sign On Stack Overflow

Advisory ID Internal CORE-2015-0006 1. Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL:https://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors...

Fortinet Single Sign On - Stack Overflow

Fortinet Single Sign On - Stack Overflow 1. Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors...

Fortinet Single Sign On - Stack Overflow

Advisory Information Title: Fortinet Single Sign On Stack Overflow Advisory ID: CORE-2015-0006 Advisory URL: http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow Date published: 2015-03-18 Date of last update: 2015-03-18 Vendors contacted: Fortinet Release mode:...

Fortinet Single Sign buffer overflow

Buffer overflow on network messages parsing...

Open redirect

Open redirect vulnerability in the Services single sign-on server helper servicesssoserverhelper module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...