[SECURITY] [DLA 1983-1] simplesamlphp security update

Package : simplesamlphp Version : 1.13.1-2+deb8u3 CVE ID : CVE-2019-3465 Debian Bug : 944107 It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages. For Debian 8 "Jessie", this problem has been...

[SECURITY] [DSA 4560-1] simplesamlphp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4560-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst November 06, 2019 https://www.debian.org/security/faq -...

DSA-4560-1 simplesamlphp - security update

Bulletin has no description...

DLA-1983-1 simplesamlphp - security update

Bulletin has no description...

proxystatistics module for SimpleSAMLphp SQL Injection Vulnerability

proxystatistics module for SimpleSAMLphp is a module for SimpleSAMLphp that supports displaying proxy IdP/SP statistics. A SQL injection vulnerability exists in the lib/Auth/Process/DatabaseCommand.php file in the proxystatistics module prior to version 3.1.0 for SimpleSAMLphp, which can be...

SQL Injection

cesnet/simplesamlphp-module-proxystatistics is vulnerable to SQL injection. The vulnerability exists as the statements in lib/Auth/Process/DatabaseCommand.php is not parameterized...

CVE-2019-15537

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

CVE-2019-15537

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

Sql injection

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

CVE-2019-15537

The CVE-2019-15537 entry concerns the proxystatistics module for SimpleSAMLphp, affected when using versions prior to 3.1.0. The underlying issue, as described across connected sources, is an SQL injection vulnerability in lib/Auth/Process/DatabaseCommand.php due to non-parameterized statements. ...

CVE-2019-15537

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php...

Fedora 28 : php-simplesamlphp-saml2_3 (2018-8cda2309d6)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Fedora 28 : php-simplesamlphp-saml2_1 (2018-0ee228da17)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Fedora 28 : php-simplesamlphp-saml2 (2018-85cb15befd)

SSPSA 201803-01 / CVE-2018-7711 - SSPSA 201802-01 / CVE-2018-7644 - SSPSA 201801-01 / CVE-2018-6519 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much...

Credentials exposure in session storage

More info at https://simplesamlphp.org/security/201812-01...

Authentication Bypass

SimpleSAMLphp is vulnerable to authentication bypasses. A malicious user can pass an unsigned SAML response with multiple assertions to the application. As long as one of the assertions are valid the application will consider the SAML response valid and grant access to the malicious user...

Debian: Security Advisory (DLA-1408-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1408-1 : simplesamlphp security update

CVE-2017-12872 / CVE-2017-12868 The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret...

[SECURITY] [DLA 1408-1] simplesamlphp security update

Package : simplesamlphp Version : 1.13.1-2+deb8u2 CVE ID : CVE-2017-12868 CVE-2017-12872 CVE-2017-12872 / CVE-2017-12868 The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing...

DLA-1408-1 simplesamlphp - security update

Bulletin has no description...