CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 3CVE-2018-16794
https://notcve.org/view.php?id=CVE-2018-16794
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls. Microsoft ADFS 4.0 Windows Server 2016 y anteriores (Active Directory Federation Services) tiene una vulnerabilidad Server-Side Request Forgery (SSRF) mediante el parámetro txtBoxEmail en /adfs/ls. • http://packetstormsecurity.com/files/149376/Microsoft-ADFS-4.0-Windows-Server-2016-Server-Side-Request-Forgery.html http://seclists.org/fulldisclosure/2018/Sep/13 http://www.securityfocus.com/bid/105378 https://seclists.org/bugtraq/2018/Sep/26 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 13%CPEs: 2EXPL: 0CVE-2015-1757
https://notcve.org/view.php?id=CVE-2015-1757
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability." Vulnerabilidad de XSS en adfs/ls en Active Directory Federation Services (AD FS) en Microsoft Windows Server 2008 SP2 y R2 SP1 y Server 2012 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro wct, también conocido como 'vulnerabilidad de la elevación de privilegios de XSS de ADFS.' • http://www.securityfocus.com/bid/75023 http://www.securitytracker.com/id/1032526 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-062 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2014-6331
https://notcve.org/view.php?id=CVE-2014-6331
Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, and 3.0, when a configured SAML Relying Party lacks a sign-out endpoint, does not properly process logoff actions, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability." Microsoft Active Directory Federation Services (AD FS) 2.0, 2.1, y 3.0, cuando a un SAML Relying Party configurado le falta un cierre de sesión del endpoint, no procesa debidamente las acciones logoff, lo que facilita a atacantes remotos obtener acceso mediante el aprovechamiento de una estación de trabajo desatendida, también conocido como 'vulnerabilidad de divulgación de información de Microsoft Active Directory Federation Services' • http://blogs.technet.com/b/srd/archive/2014/11/11/assessing-risk-for-the-november-2014-security-updates.aspx http://www.securityfocus.com/bid/70938 http://www.securitytracker.com/id/1031195 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-077 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 2%CPEs: 5EXPL: 0CVE-2013-3185
https://notcve.org/view.php?id=CVE-2013-3185
Microsoft Active Directory Federation Services (AD FS) 1.x through 2.1 on Windows Server 2003 R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 allows remote attackers to obtain sensitive information about the service account, and possibly conduct account-lockout attacks, by connecting to an endpoint, aka "AD FS Information Disclosure Vulnerability." Microsoft Active Directory Federation Services (AD FS) v1.x hasta v2.1 en Windows Server 2003 R2 SP2, Windows Server 2008 SP2 y R2 SP1, y Windows Server 2012 permite a atacantes remotos obtener información sensible acerca de la cuenta de servicio, y posiblemente llevar a cabo ataques de bloqueo de cuentas, mediante la conexión a un punto final, también conocido como "AD FS Information Disclosure Vulnerability". • http://www.us-cert.gov/ncas/alerts/TA13-225A https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-066 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18318 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •