Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On January 2021 CPU

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

CVE-2021-3034

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on SSO integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the...

CVE-2021-3034

An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on SSO integration can be logged to the '/var/log/demisto/' server logs when testing the integration during setup. This logged information includes the...

Red Hat Single Sign-On 7安全漏洞

Red Hat Single Sign-On 7 is a Web single sign-on and identity federation based on the Saml 2.0, OpenId Connect, and Oauth 2.0 specifications from Red Hat USA. A security vulnerability exists in Red Hat Single Sign-On 7 that allows attacks that emulate a user's internationalized domain name IDN...

CVE-2020-5148

SonicWall SSO-agent default configuration uses NetAPI to probe the associated IP's in the network, this client probing method allows a potential attacker to capture the password hash of the privileged user and potentially forces the SSO Agent to authenticate allowing an attacker to bypass firewal...

SonicWall SSO-agent 授权问题漏洞

SonicWall SSO-agent is a software application from SonicWall, Inc. SonicWall SSO-agent is a software application from SonicWall, Inc. that provides a single login to provide access to multiple network resources based on administrator-configured group membership and policy matching. A security...

How to Force Connections Through NetScaler Gateway Using Optimal Gateway Feature of StoreFront

This article describes how to use the Optimal Gateway setting available in StoreFront to force applications to launch through NetScaler Gateway. It applies when accessing StoreFront through Citrix Receiver to connect to NetScaler Gateway virtual server and launching resources from XenApp/XenDeskt...

Local Services Search Engine Management System (LSSMES) 1.0 - (name) XSS Vulnerability

Exploit Title: Local Services Search Engine Management System LSSMES 1.0 - 'name' Persistent Cross-Site Scripting XSS Exploit Author: Tushar Vaidya Vendor Homepage: https://phpgurukul.com/local-services-search-engine-management-system-using-php-and-mysql/ Software Link:...

argo-cd 跨站脚本漏洞

GitHub argo-cd is an open source application from Github. A declarative GitOps continuous delivery tool for Kubernetes. github.com/argoproj/argo-cd/cmd A cross-site scripting vulnerability exists, which stems from the fact that SSO providers connecting to Argo CD will have to send malicious error...

CVE-2021-3148

A flaw was found in salt. Command injection using the SaltAPI, is possible due to json.dumps escaping double quotes while leaving the single quotes untouched. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2021-23956

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading a whole directory. This was addressed by adding a new prompt. This vulnerability affects Firefox 85...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On January 2021 CPU

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Shanghai Niuzhiyun Network Technology Co., Ltd.'s Single Merchant V4 System Has Arbitrary File Deletion Vulnerability

Single merchant V4 system is a framework using the new thinkphp6 + event development design + layui + uniapp for the design of open source merchant system. Shanghai Niuzhiyun Network Technology Co., Ltd. single merchant V4 system there are arbitrary file deletion vulnerability, an attacker can...

note-mark

Note Mark !License: AGPL V3https://img.shields.io/github/li...

Troubleshooting Citrix Pass-Through Authentication

This article outlines workarounds and resolutions to specific Citrix pass-through authentication issues. Common Pass-Through Authentication Issues and Inquiries Refer to the following links for information on common pass-through authentication issues and inquiries: Citrix Docs - Enabling...

CVE-2021-25296

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS...

Command injection

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command...

SSRF in adminer

Impact Users of Adminer versions bundling all drivers e.g. adminer.php are affected. Patches Patched by ccd2374b, included in version 4.7.9. Workarounds Use a single driver version e.g. adminer-mysql.php. Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...