CVE Vulnerability Advisory Database

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] SimpleHelp versions 5.5.15 and prior, and 6.0 pre-release versions with OIDC authentication configured

[Impact] Unauthenticated remote attackers can forge identity tokens to bypass authentication, gain full technician sessions, and potentially bypass multi-factor authentication (MFA)

[Mitigation] Immediately upgrade SimpleHelp to the patched version or disable OIDC authentication until the patch is applied

[Affected Scope] FortiOS 7.0.0-7.0.17 / 7.2.0-7.2.11 / 7.4.0-7.4.8 / 7.6.0-7.6.3, FortiProxy 7.0.0-7.0.21 / 7.2.0-7.2.14 / 7.4.0-7.4.10 / 7.6.0-7.6.3, FortiSwitchManager 7.0.0-7.0.5 / 7.2.0-7.2.6.

[Impact] An unauthenticated remote attacker can bypass FortiCloud SSO authentication via a crafted SAML response message, gaining full administrative access to the affected device.

[Mitigation] Immediately upgrade to the patched firmware versions, or disable FortiCloud SSO login and restrict administrative access to trusted IP addresses as a temporary workaround.

[Affected Scope] PAN-OS 8.1, 9.0, and 9.1 versions, Panorama, and GlobalProtect gateways with SAML authentication enabled and 'Validate Identity Provider Certificate' disabled

[Impact] Unauthenticated remote attackers can bypass SAML signature verification to gain administrative access to PAN-OS/Panorama web interfaces or access protected network resources

[Mitigation] Upgrade PAN-OS to patched versions (9.1.3, 9.0.9, 8.1.15 or later) or enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile