Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2015-0277

PicketLink: SP does not take Audience condition of a SAML assertion into account

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.

CVSS 2.0 · 6.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Picketlink Redhat
Products
Picketlink Jboss Enterprise Application Platform
CVE-2015-3158

PicketLink: PicketLink IDP ignores role based authorization

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

CVSS 2.0 · 4.0 Medium EPSS 1.9% KEV · Not listed
Vendors
Picketlink Redhat
Products
Picketlink Jboss Enterprise Application Platform
CVE-2015-6254

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Picketlink Redhat
Products
Picketlink Jboss Enterprise Application Platform