737 matches found
[SECURITY] [DSA 5822-1] simplesamlphp security update
------------------------------------------------------------------------- Debian Security Advisory DSA-5822-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 02, 2024 https://www.debian.org/security/faq -...
CVE-2024-52806: Improper Restriction of XML External Entity Reference
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an untrusted XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18...
SimpleSAMLphp security vulnerability
SimpleSAMLphp is a PHP authentication application that implements SAML 2.0 service provider and identity provider functionality. A security vulnerability exists in SimpleSAMLphp that originates when loading an untrusted XML document that induces XML external entity injection...
DLA-3981-1 simplesamlphp - security update
Bulletin has no description...
PT-2024-35392
Name of the Vulnerable Software and Affected Versions SimpleSAMLphp xml-common versions prior to 1.19.0 Description The issue arises when loading an untrusted XML document, such as the SAMLResponse, allowing an attacker to induce an XML External Entity XXE attack. This could potentially enable an...
PT-2024-35456 · Unknown · Simplesamlphp Saml2 Library
Name of the Vulnerable Software and Affected Versions: SimpleSAMLphp SAML2 library versions prior to 4.6.14 SimpleSAMLphp SAML2 library versions prior to 5.0.0-alpha.18 Description: The SimpleSAMLphp SAML2 library is vulnerable to an XML External Entity XXE attack when loading untrusted XML...
DSA-5822-1 simplesamlphp - security update
Bulletin has no description...
SimpleSAMLphp security vulnerability
SimpleSAMLphp is a PHP authentication application that implements SAML 2.0 service provider and identity provider functionality. A security vulnerability exists in SimpleSAMLphp that originates when xml-common loads an untrusted XML document, inducing XML external entity injection...
CVE-2024-52596: Improper Restriction of XML External Entity Reference
SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an untrusted XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0...
Debian dla-3981 : simplesamlphp - security update
The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3981 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3981-1 [email protected] https://www.debian.org/lts/security/...
Debian dsa-5822 : simplesamlphp - security update
The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5822 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5822-1 [email protected] https://www.debian.org/security/...
Insufficiently Protected Credentials
SimpleSAMLphp is vulnerable to Insufficiently Protected Credentials. The vulnerability is due to credentials being insecurely saved to the user's session state when the ECP profile is disabled but supported in the Identity Provider's metadata, which could result in an attacker with administrator...
Cross-site Scripting (XSS)
SimpleSAMLphp is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unvalidated metadata endpoints, allowing malicious parties to substitute URLs with JavaScript code, leading to execution of the code in the user's browser if strict Content Security Policies are not enforced...
Information Disclosure
simplesamlphp/simplesamlphp is vulnerable to Information Disclosure. The vulnerability is due to insufficient access controls on the admin interface endpoint, allowing unauthenticated users to view sensitive information about the host where SimpleSAMLphp is installed...
Open Redirect
simplesamlphp/simplesamlphp is vulnerable to Open Redirect. The vulnerability is due to improper validation of URLs in request parameters, allowing an attacker to redirect a user to a malicious site...
SimpleSAMLphp Information Disclosure vulnerability
Background SimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled...
GHSA-PPM4-R2VC-PG74 SimpleSAMLphp Information Disclosure vulnerability
Background SimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled...
SimpleSAMLphp Reflected Cross-site Scripting vulnerability
Background SimpleSAMLphp uses metadata to determine how to interact with other SAML entities. This metadata includes what’s called endpoints, which are URLs belonging to that entity where SAML messages can be sent. These URLs are used directly by SimpleSAMLphp when a message is sent, either via a...
GHSA-VPR3-CW3H-PRW8 SimpleSAMLphp Reflected Cross-site Scripting vulnerability
Background SimpleSAMLphp uses metadata to determine how to interact with other SAML entities. This metadata includes what’s called endpoints, which are URLs belonging to that entity where SAML messages can be sent. These URLs are used directly by SimpleSAMLphp when a message is sent, either via a...
SimpleSAMLphp exposes credentials in session storage
Background In order to implement support for the SAML Enhanced Client or Proxy profile, the credentials obtained for authentication were stored in the state in order to pass them to the relevant routines. This, however, led to the credentials being recorded in the user’s session, which can be...