Mozilla: Same-compartment Security Wrappers can be bypassed (MFSA 2012-49)

Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers SCSW during the cross-compartment wrapping of objects, which allows remo...

CVE-2012-1959

Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not consider the presence of same-compartment security wrappers SCSW during the cross-compartment wrapping of objects, which allows remo...

IBM WebSphere Application Server 7.x < 7.0.0.19 OpenSAML XML Signature Wrapping Vulnerability

IBM WebSphere Application Server ships a OpenSAML implementation which is prone to a security vulnerability involving XML signature wrapping. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

CVE-2011-1411

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

Authentication flaw

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2011-1411

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2011-1411: Improper Authentication

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

PT-2011-3107

Name of the Vulnerable Software and Affected Versions Shibboleth OpenSAML library versions 2.4.x through 2.4.2 Shibboleth OpenSAML library versions 2.5.x through 2.5.0 Shibboleth IdP versions prior to 2.3.2 Description The issue allows remote attackers to forge messages and bypass authentication...

FreeBSD : opensaml2 -- unauthenticated login (9f14cb36-b6fc-11e0-a044-445c73746d79)

OpenSAML developer reports : The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called 'wrapping attack' that allows a remote, unauthenticated...

[SECURITY] [DSA 2284-1] opensaml2 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2284-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff July 25, 2011 http://www.debian.org/security/faq -...

Debian DSA-2284-1 : opensaml2 - implementation error

Juraj Somorovsky, Andreas Mayer, Meiko Jensen, Florian Kohlar, Marco Kampmann and Joerg Schwenk discovered that Shibboleth, a federated web single sign-on system is vulnerable to XML signature wrapping attacks. More details can be found in the Shibboleth advisory. %NASLMINLEVEL 70300 C Tenable...

DSA-2284-1 opensaml2 - implementation error

Bulletin has no description...

opensaml2 -- unauthenticated login

OpenSAML developer reports: The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated...

Cross site request forgery (csrf)

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...

CVE-2011-0730

CVE-2011-0730 affects Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2. The issue arises from improper interpretation of signed elements in SOAP requests, enabling man-in-the-middle attackers to modify a request and execute arbitrary commands. This is tied to XML Signature Element Wrapping ...

CVE-2011-0730

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...

CVE-2011-0730: Improper Input Validation

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...

PT-2011-2591

Name of the Vulnerable Software and Affected Versions Eucalyptus versions prior to 2.0.3 Eucalyptus EE versions prior to 2.0.2 Description The issue is related to the improper interpretation of signed elements in SOAP requests, which can be exploited by man-in-the-middle attackers to execute...

(0Day) HP 3COM/H3C Intelligent Management Center img recv Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of HP 3COM/H3C Intelligent Management Center. Authentication is not required to exploit this vulnerability. The flaw exists within the img.exe component which listens by default on TCP port 8800. When...

CVE-2011-0730

Eucalyptus before 2.0.3 and Eucalyptus EE before 2.0.2, as used in Ubuntu Enterprise Cloud UEC and other products, do not properly interpret signed elements in SOAP requests, which allows man-in-the-middle attackers to execute arbitrary commands by modifying a request, related to an "XML Signatur...