1738 matches found
PT-2024-17571
Name of the Vulnerable Software and Affected Versions OIDC-Client versions prior to the fixed version EAP 7.x EAP 8.x Description A vulnerability was found in OIDC-Client, allowing authorization code injection attacks to occur when using the RH SSO OIDC adapter with EAP 7.x or the...
OIDC-Client 数据伪造问题漏洞
OIDC-Client is an IdentityModel open source library that provides OpenID Connect OIDC and OAuth2 protocol support for client-side, browser-based JavaScript client applications. OIDC-Client suffers from a data forgery issue vulnerability that stems from an authorization code injection attack that...
Race Condition
Overview fastapi-sso is a FastAPI plugin to enable SSO to most common providers such as Facebook login, Google login and login via Microsoft Office 365 Account Affected versions of this package are vulnerable to Race Condition. When multiple concurrent login requests are processed simultaneously,...
CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...
CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used
A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...
[SECURITY] Fedora 41 Update: lemonldap-ng-2.20.1-1.fc41
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 39 Update: lemonldap-ng-2.20.1-1.fc39
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
[SECURITY] Fedora 40 Update: lemonldap-ng-2.20.1-1.fc40
LemonLdap::NG is a modular Web-SSO based on Apache::Session modules. It simplifies the build of a protected area with a few changes in the application. It manages both authentication and authorization and provides headers for accounting. So you can have a full AAA protection for your web space as...
CVE-2024-8535
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as...
CVE-2024-8535
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as...
CVE-2024-8535
Affected products: Citrix NetScaler ADC and NetScaler Gateway. Vulnerability: Authenticated users can access unintended user capabilities when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with Kerberos SSO using a KCDAccount, or as an Auth Server (AAA Vserver) wi...
CVE-2024-8535 Authenticated user can access unintended user capabilities
Authenticated user can access unintended user capabilities in NetScaler ADC and NetScaler Gateway if the appliance must be configured as a Gateway SSL VPN, ICA Proxy, CVPN, RDP Proxy with KCDAccount configuration for Kerberos SSO to access backend resources OR the appliance must be configured as...
GitHub Enterprise - SAML Authentication Bypass
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. Exploitation required the encrypted assertions feature to be...
Mattermost Desktop 9.5.x < 9.5.9 / 9.11.x < 9.11.1 (MMSA-2024-00363)
The version of Mattermost Desktop installed on the remote host is prior to 9.5.9 or 9.11.1. It is, therefore, affected by a vulnerability as referenced in the MMSA-2024-00363 advisory. - Mattermost versions 9.11.X = 9.11.1, 9.5.x = 9.5.9 icorrectly issues two sessions when using desktop SSO - one...
GO-2024-3227 Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server
Mattermost incorrectly issues two sessions when using desktop SSO in github.com/mattermost/mattermost-server...
GHSA-HM57-H27X-599C Mattermost incorrectly issues two sessions when using desktop SSO
Mattermost versions 9.11.X = 9.11.1, 9.5.x = 9.5.9 incorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings...
Mattermost incorrectly issues two sessions when using desktop SSO
Mattermost versions 9.11.X = 9.11.1, 9.5.x = 9.5.9 incorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings...
CVE-2024-10214
Mattermost versions 9.11.X = 9.11.1, 9.5.x = 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings...
CVE-2024-10214
CVE-2024-10214 affects Mattermost: specifically Mattermost 9.11.x (<=9.11.1) and 9.5.x (
CVE-2024-10214 Incorrect Session Creation with Desktop SSO
Mattermost versions 9.11.X = 9.11.1, 9.5.x = 9.5.9 icorrectly issues two sessions when using desktop SSO - one in the browser and one in desktop with incorrect settings...