1738 matches found
RHSA-2020:0946 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 7
Bulletin has no description...
CVE-2024-45101
The CVE-2024-45101 issue affects Lenovo XClarity Administrator (LXCA) where enabling Single Sign-On (SSO) can lead to privilege escalation by intercepting a valid authenticated user’s XCC session. The vulnerability arises when a user is tricked into clicking a specially crafted URL, enabling an a...
CVE-2024-45101
A privilege escalation vulnerability was discovered when Single Sign On SSO is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL...
CVE-2024-6582
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...
CVE-2024-6582
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...
RHSA-2019:3049 Red Hat Security Advisory: RH-SSO 7.3.4 adapters for Enterprise Application Platform 7.2 security update
Bulletin has no description...
RHSA-2019:3048 Red Hat Security Advisory: RH-SSO 7.3.4 adapters for Enterprise Application Platform 6 security update
Bulletin has no description...
CVE-2024-6582 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...
CVE-2024-6582 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The saml.ts file allows a user from one organization to update the Identity Provider IDP settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and...
CVE-2024-6582
CVE-2024-6582 describes a broken access control in lunary-ai/lunary where the saml.ts component allows a user from one organization to modify IDP settings and view SSO metadata of another organization, potentially enabling unauthorized access and account takeover if a target email is known. This ...
Lenovo XClarity Administrator (LXCA) Vulnerabilities - Lenovo Support US
No description provided...
CVE-2022-45856
An improper certificate validation vulnerability CWE-295 in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all...
CVE-2022-45856
An improper certificate validation vulnerability CWE-295 in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7, FortiClientMac 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientLinux 6.4 all versions, 7.0 all versions, 7.2.0 through 7.2.4, FortiClientAndroid 6.4 all...
CVE-2022-45856
CVE-2022-45856 affects FortiClient across multiple platforms with an improper certificate validation (CWE-295) in the SAML SSO feature, potentially allowing an unauthenticated attacker to perform a man-in-the-middle between FortiClient and both the service provider and identity provider. Affected...
Fortinet FortiClient (All) - Lack of client-side certificate validation using SAML SSO (FG-IR-22-230)
The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-230 advisory. - An improper certificate validation vulnerability CWE-295 in FortiClientWindows 6.4 all versions, 7.0.0 through 7.0.7,...
Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 8
New Red Hat Single Sign-On 7.6.10 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Microsoft Azure Active Directory Login Enumeration
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Azure Active Directory Login Enumeration', 'Description' = %q This module enumerates valid usernames and passwords against a Microsoft...
Casdoor has reflected XSS in QrCodePage.js (GHSL-2024-036)
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via...
GHSA-MCHX-7J67-8MCF Casdoor CORS misconfiguration (GHSL-2024-035)
Casdoor is a UI-first Identity and Access Management IAM / Single-Sign-On SSO platform. In Casdoor 1.577.0 and earlier, a logic vulnerability exists in the beego filter CorsFilter that allows any website to make cross domain requests to Casdoor as the logged in user. Due to the a logic error in...