How IT leaders are securing identities with Zero Trust

The past twelve months have been a remarkable time of digital transformation as organizations, and especially digital security teams, adapt to working remotely and shifting business operations. IT leaders everywhere turned to Zero Trust approaches to alleviate the challenges of enabling and...

How IT leaders are securing identities with Zero Trust

The past twelve months have been a remarkable time of digital transformation as organizations, and especially digital security teams, adapt to working remotely and shifting business operations. IT leaders everywhere turned to Zero Trust approaches to alleviate the challenges of enabling and...

ADC VPX on Azure Cloud : Unable to boot due to error : can't load 'kernel'

Citrix VPX on Azure is unable to boot. In Azure console; Under Boot Diagnostics, it is observed that the booting is not completed. The error "can't load 'kernel'" is seen and the VPX boots in single-user mode...

CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

Design/Logic Flaw

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

CVE-2020-14341

CVE-2020-14341 affects Red Hat Single Sign On (RHSSO) v7.x: the Test Connection feature in the console can cause SMTP connections to arbitrary hosts/ports from the RHSSO installation. This creates a timing side‑channel where an authorized user may infer information about hosts/ports they cannot s...

CVE-2020-14341

The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timin...

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On October 2020 CPU

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

CVE-2020-8160

MendixSSO = 2.1.1 contains endpoints that make use of the openid handler, which is suffering from a Cross-Site Scripting vulnerability via the URL path. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload m...

Zammad SSO Endpoint Authentication Bypass Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

Zammad 授权问题漏洞

Zammad is a Web-based open source helpdesk/customer support system. An SSO endpoint authentication bypass vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability by creating a valid authentication session to perform any action in the name of another user...

CVE-2020-26172

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp...

RHEL 7 : Red Hat Single Sign-On 7.4.4 security update on RHEL 7 (Low) (RHSA-2020:5527)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5527 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

RHEL 6 : Red Hat Single Sign-On 7.4.4 security update on RHEL 6 (Low) (RHSA-2020:5526)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5526 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

RHEL 8 : Red Hat Single Sign-On 7.4.4 security update on RHEL 8 (Low) (RHSA-2020:5528)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5528 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.0 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Cannot Complete Your Request Error only occurs to certain users connecting from ADC with Azure MFA over to Storefront

Certain users are receiving Cannot Complete Your Request Error when accessing site via ADC url and after entering their Azure MFA credentials and user is redirected to Storefront's URL, then the error is observed. On the Storefront Server we see the following Event: Log Name: Citrix Delivery...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.4 on OpenJDK for OpenShift image security update

A new image is available for Red Hat Single Sign-On 7.4.4 on OpenJDK, running on OpenShift Container Platform of versions 3.10, 3.11, up to the 4.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Low: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.4 security update on RHEL 8

New Red Hat Single Sign-On 7.4.4 packages are now available for Red Hat Enterprise Linux 8. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. This release ...