New Relic: SSO Authentication Bypass

Hi, As I reported to [email protected], here's the authentication bypass vulnerability report. I've left some details out in this report but you're welcome to reach out to me with any questions. Here's a more detailed overview: SSO Authentication Bypass Summary It is possible to POST a custom...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 53.0.2785.103 Platform version: 8530.81.0 for all Chrome OS devices except Google Chromebook Pixel 2015, Acer Chromebook R11, ASUS Chromebook Flip C100PA, HP Chromebox CB1, and Acer C7 Chromebook. This build contains a number of bug fixes, security updates,...

sso.garmin.com Open Redirect vulnerability

Vulnerable URL: https://sso.garmin.com/sso/login?service=https://www.openbugbounty.org=olaxpw-conctmodern008=true Details: Description| Value ---|--- Patched:| Yes, at 23.08.2017 Latest check for patch:| 23.08.2017 11:55 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly...

CVE-2016-3687

Summary (CVE-2016-3687) Open redirect vulnerability in F5 BIG-IP APM (multi‑domain SSO) and BIG-IP Edge Gateway, caused by insufficient validation of the SSO_ORIG_URI parameter. Affected: BIG-IP APM 11.4.0–11.6.0 (and 11.2.1); Edge Gateway 11.2.1. Attacker can craft base64‑encoded SSO_ORIG_URI to...

F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (K26738102)

Insufficient validation of the SSOORIGURI parameter occurs when using multi-domain single sign-on SSO. CVE-2016-3687 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution K26738102. The text description of this plug...

WordPress OneLogin SAML SSO Plugin <= 2.1.5 - Authentication Bypass

This plugin has a bug which allows anyone to login without a password or other authentication. Solution Update the plugin...

OneLogin SAML SSO <= 2.1.5 - Authentication Bypass

The OneLogin SAML SSO WordPress plugin was affected by an Authentication Bypass security vulnerability...

WordPress OneLogin SAML SSO Plugin <= 2.1.8 - Privilege Escalation

This plugin is prone to a privilege escalation vulnerability. Solution Update the plugin...

OneLogin SAML SSO <= 2.1.8 - Provisioned User Hardcoded Password

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability...

myratner.com XSS vulnerability

Vulnerable URL: https://myratner.com/sso/SSOServlet?locale=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5405067 VIP website...

careers.everettclinic.com XSS vulnerability

Vulnerable URL: https://careers.everettclinic.com/sso/SSOServlet?locale=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown /...

azstatejobs.azdoa.gov XSS vulnerability

Vulnerable URL: https://azstatejobs.azdoa.gov/sso/SSOServlet?locale=" Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check azstatejobs.azdoa.gov SSL connection:|...

sso.amerisourcebergen.com XSS vulnerability

Vulnerable URL: https://sso.amerisourcebergen.com/oaamserver/?app=...

Uber: OneLogin authentication bypass on WordPress sites

First, I'm sorry about reporting another WordPress bug my intention was just to check if WP-OneLogin stores any sensitive info that could be used to attack OneLogin on your other websites. Overview The .uber.com WordPress sites use OneLogin SAML-SSO instead of the normal WordPress login. The...

F5 BIG-IP - BIG-IP APM SSO vulnerability CVE-2016-3686

The remote host is missing a security patch. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/h:f5:big-ip"; if description...

Ubiquiti Inc.: Reflected XSS in scores.ubnt.com

Parameter p in https://scores.ubnt.com/form.html?uid=1&p=airFiber is vulnerable to XSS. If a user logs in at https://account.ubnt.com/login and visits https://scores.ubnt.com/form.html?uid=1&p=airFiber"alertdocument.cookie;, a message box will be presented with his cookie. Attached is a POC...

CVE-2016-3686

The CVE-2016-3686 issue affects F5 BIG-IP APM SSO (and BIG-IP Edge Gateway) where Cleartext SessionID can appear in the Location header during redirects. Affected are BIG-IP APM 11.0.0–11.6.0 (HF6 in 11.6.0) and BIG-IP Edge Gateway 11.0.0–11.3.0; other components are listed as affected/not vulner...

F5 Networks BIG-IP : BIG-IP APM SSO vulnerability (SOL82679059)

Cleartext SessionID is visible in URL query parameters under some conditions. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution SOL82679059. The text description of this plugin is C F5 Networks...

ssologin.inbcu.com XSS vulnerability

Vulnerable URL: https://ssologin.inbcu.com/ssologin/ssologin.jsp?TYPE=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0...

SOL82679059 - BIG-IP APM SSO vulnerability CVE-2016-3686

Vulnerability Recommended Actions If you are running a version listed in the Versions known to be vulnerable column, you can eliminate this vulnerability by upgrading to a version listed in the Versions known to be not vulnerable column. If the table lists only an older version than what you are...