CVE-2018-0229

CVE-2018-0229 affects Cisco AnyConnect Secure Mobility Client, ASA, and FTD software configured for SAML 2.0-based SSO. Root cause: ASA/FTD fail to detect if an authentication request originates from the AnyConnect client, enabling a session-fixation path where a user’s IdP authentication token c...

SSO PassThrough is not working in Microsoft Edge Browser.

SSO Pass-through is not working in Microsoft Edge Browser...

Watchfulli SSO Plugin,1.2, Other

Watchfulli SSO Plugin, versions 1.2 and previous, Other Resolution: update to version 1.3 update notice: https://watchful.li/news-blog/news/new-watchful-clients-and-sso-plugin-enhance-encryption...

Spoofing

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on SSO systems IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2. This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a differe...

CVE-2018-1443

The CVE-2018-1443 issue affects IBM Security Access Manager (IAS) Appliance versions 9.0.0–9.0.4 and IBM Tivoli Federated Identity Manager (TFIM) versions 6.2, 6.2.1, and 6.2.2, due to an XML parsing vulnerability in the SAML-based SSO flow. An attacker with authenticated access could trick the S...

aai-logon.ethz.ch XSS vulnerability

Open Bug Bounty ID: OBB-568696 Description| Value ---|--- Affected Website:| aai-logon.ethz.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

CVE-2018-7211

CVE-2018-7211 affects iDashboards 9.6b where the SSO implementation relies on a weak obfuscation library, enabling MITM attackers to recover credentials. The vulnerability is described consistently across NVD/Red Hat records and related feeds; no exploit details or affected version ranges beyond ...

CVE-2018-7211

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing man-in-the-middle attackers to discover credentials...

Rockstar Games: SocialClub's Facebook OAuth Theft through Warehouse XSS.

In this report, the researcher was able to chain together 3 separate, minor bugs to create an exploit that was greater than the sum of its parts. This exploit could have potentially allowed attackers to steal OAuth tokens from users. The exploit chain involved taking advantage of our SSO between...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2015-6926

The vulnerability CVE-2015-6926 affects the OpenID Single Sign-On authentication in OXID eShop (pre-4.5.0). A crafted authentication token that includes a user email enables remote attackers to impersonate legitimate users. Documents from NVD, GHSA, OSV, CNVD/CNVD-like sources consistently descri...

Design/Logic Flaw

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

CVE-2018-5280

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

CVE-2018-5280

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...

CVE-2018-5280

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens...