CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 3CVE-2018-16794
https://notcve.org/view.php?id=CVE-2018-16794
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls. Microsoft ADFS 4.0 Windows Server 2016 y anteriores (Active Directory Federation Services) tiene una vulnerabilidad Server-Side Request Forgery (SSRF) mediante el parámetro txtBoxEmail en /adfs/ls. • http://packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html http://seclists.org/fulldisclosure/2018/Sep/13 http://www.securityfocus.com/bid/105378 https://seclists.org/bugtraq/2018/Sep/26 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2014-6331
https://notcve.org/view.php?id=CVE-2014-6331
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability." Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, y 3.0, cuando a un SAML Relying Party configurado le falta un cierre de sesión del endpoint, no procesa debidamente las acciones logoff, lo que facilita a atacantes remotos obtener acceso mediante el aprovechamiento de una estación de trabajo desatendida, también conocido como 'vulnerabilidad de divulgación de información de Microsoft Active Directory Federation Services' • http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx http://www.securityfocus.com/bid/70938 http://www.securitytracker.com/id/1031195 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077 • CWE-264: Permissions, Privileges, and Access Controls •