CVE-2023-4102 Multiple vulnerabilities in IDM Sistemas QSige

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

CVE-2023-4102

CVE-2023-4102 affects the QSige login SSO in IDM Sistemas QSige. The root cause is the absence of an access control mechanism to verify that a requesting user has sufficient permissions before granting access to a resource. This leads to potential unauthorized access with high impact on confident...

CVE-2023-4101 Multiple vulnerabilities in IDM Sistemas QSige

The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

CVE-2023-4101

CVE-2023-4101 affects the QSige login SSO component of IDM Sistemas QSige. The root cause is a missing access control mechanism to verify that a requesting user has adequate permissions before accessing a resource, with login required as a prerequisite. Connected sources (Red Hat, NVD, CVE listin...

PT-2023-27741 · Qsige · Qsige

Name of the Vulnerable Software and Affected Versions: QSige affected versions not specified Description: The QSige login SSO lacks an access control mechanism to verify if a user has sufficient permissions to request a resource. To exploit this, a user must first log into the application...

UI Redressing (Clickjacking) with SSO Plugin for Data Center

h3. Problem Related to CONFSERVER-29230 When we enable the SAML login on General Configuration - Authentication, the Confluence login page shows inside an iframe. When disabled it doesn't show as expected with the Clickjacking disabled by default. In the gif attached, replicated the error on our...

CVE-2023-3115

GitLab Enterprise Edition: CVE-2023-3115 describes an issue where Single Sign-On restrictions were not correctly enforced for indirect project members accessing public members-only repositories. Affected versions span 11.11 up to 16.2.8, 16.3 up to 16.3.5, and 16.4 up to 16.4.1. Root cause center...

GitLab 11.11 < 16.2.8 / 16.3 < 16.3.5 / 16.4 < 16.4.1 (CVE-2023-3115)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not...

CVE-2022-4039

A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server...

Update Citrix Secure Access and SSO apps to 23.09.1 before upgrading OS on Mac and iOS devices

In general we have seen two issues with the beta releases from Apple for Sonoma and iOS 17. So if the versions prior to 23.09.1 of the Citrix Secure Access and SSO apps are used with MacOS Sonoma and iOS/iPadOS 17, then the following issues would be seen: Apps will not be able to generate the log...

ROS-20230911-07

A vulnerability in the Moodle virtual learning environment is related to insufficient validation of user input data. data, an attacker could send a specially crafted HTTP request and make the application initiate requests to arbitrary systems. Exploitation of the vulnerability could allow an...

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On SSO with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action Accept, Release, and Clear for another user and...

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On SSO with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action Accept, Release, and Clear for another user and...

CVE-2023-4816

CVE-2023-4816 affects Hitachi Energy Asset Suite (Asset Suite 9) with SSO/password validation. A authenticated user can perform an Equipment Tag Out holder action (Accept, Release, Clear) for another user and enter an arbitrary password in the confirmation dialog; the system will still execute th...

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On SSO with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action Accept, Release, and Clear for another user and...

CVE-2023-4816

A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On SSO with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action Accept, Release, and Clear for another user and...

CVE-2023-20238

A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...

Design/Logic Flaw

A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...

CVE-2023-20238

CVE-2023-20238 affects Cisco BroadWorks Application Delivery Platform and BroadWorks Xtended Services Platform. The issue is an authentication bypass in the SSO token validation logic, allowing an unauthenticated, remote attacker to forge credentials and access the system. Potential impacts inclu...

CVE-2023-20238

A vulnerability in the single sign-on SSO implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an affected system. This vulnerability is due to th...