CVE-2023-37471: Improper Authentication

Open Access Management OpenAM is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements and Web Services Security. OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-...

CVE-2022-34155

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO OAuth Client plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO OAuth Client: from n/a through 6.23.3...

CVE-2022-34155

CVE-2022-34155 applies to the WordPress plugin “miniOrange OAuth Single Sign On – SSO (OAuth Client)” and is caused by an Improper Authentication flaw that enables an Authentication Bypass. Affected versions are up to 6.23.3; exploitation could allow unauthorized access to protected resources. Th...

WordPress Impexium Single Sign On Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)

Software Impexium Single Sign On Type Plugin Vulnerable versions = 1.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0f73273fdda5 Credits Rafie Muhammad Patchstack...

WordPress Plugin OAuth Single Sign On – SSO Authorization Issues Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress Plugin OAuth Single Sign On - SSO OAuth Client...

WordPress netFORUM Single Sign On Plugin <= 1.3.5 is vulnerable to Cross Site Scripting (XSS)

Software netFORUM Single Sign On Type Plugin Vulnerable versions = 1.3.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9ddecf76497f Credits Rafie Muhammad Patchstack...

CVE-2022-34155: Improper Authentication

Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO OAuth Client plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO OAuth Client: from n/a through 6.23.3...

WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Broken Access Control

Software YourMembership Single Sign On Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-37987 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 9b1dfdc28505 Credits Aman Rawat...

WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

Software YourMembership Single Sign On Type Plugin Vulnerable versions = 1.1.3 Fixed in 1.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37986 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a6981a4d8c88 Credits Aman Rawa...

Warpgate Authorization Issue Vulnerability

Warpgate is a smart SSH, HTTPS and MySQL bastion host for Linux from the warp-tech project. Warpgate suffers from an authorization problem vulnerability that stems from the fact that when logged in as an SSO-enabled user, an attacker may be able to pass authentication as another user...

PT-2023-25871 · Warpgate · Warpgate

Name of the Vulnerable Software and Affected Versions: Warpgate versions prior to 0.7.3 Description: Warpgate is an SSH, HTTPS, and MySQL bastion host for Linux that does not require special client apps. An issue exists where an attacker may authenticate as another user when logging in as a user...

The admin is a single point of failure and a centralization risk

Lines of code Vulnerability details Impact Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure. A single private key may be taken in a hack, or the sole holder of the key may become unable to retrieve the key when necessary. Consider...

GHSA-P4WR-9WFM-F9JW Jenkins SAML Single Sign On(SSO) Plugin missing permission check

Jenkins SAML Single Sign OnSSO Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to download a string representation of the current security realm Java ObjecttoString, which potentially includes sensitive...

Jenkins SAML Single Sign On(SSO) Plugin missing permission check

Jenkins SAML Single Sign OnSSO Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to download a string representation of the current security realm Java ObjecttoString, which potentially includes sensitive...

CVE-2023-37945

The CVE concerns Jenkins SAML Single Sign On (SSO) Plugin. A missing permission check in HTTP endpoints allows attackers with Overall/Read to download a string representation of the current security realm. Affected versions are 2.1.0 through 2.3.0; 2.3.1 fixes the issue. Impacts are limited to in...

CVE-2023-37945

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.1.0 through 2.3.0 both inclusive allows attackers with Overall/Read permission to download a string representation of the current security realm...

CVE-2023-37945

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.1.0 through 2.3.0 both inclusive allows attackers with Overall/Read permission to download a string representation of the current security realm...

Jenkins Plugin SAML Single Sign On (SSO) Security Vulnerabilities

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

PT-2023-26193

Name of the Vulnerable Software and Affected Versions Jenkins SAML Single Sign OnSSO Plugin versions 2.1.0 through 2.3.0 Description A missing permission check in the Jenkins SAML Single Sign OnSSO Plugin allows attackers with Overall/Read permission to download a string representation of the...

CVE-2023-37945: Missing Authorization

A missing permission check in Jenkins SAML Single Sign OnSSO Plugin 2.1.0 through 2.3.0 both inclusive allows attackers with Overall/Read permission to download a string representation of the current security realm...