Patrick Uiterwijk

**Nome do software vulnerável e versões afetadas: Versões 5.8.1 e anteriores do Keylime Descrição: Foi detectada uma falha no código do agente e do registrador do Keylime, que invalida a cadeia de confiança criptográfica entre o certificado da Chave de Endosso e as atestações do agente. Recomendações: Para as versões 5.8.1 e anteriores do Keylime, atualize para uma versão posterior à 5.8.1 para resolver o problema. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** ipsilon versions 1.0 through 1.0.2 ipsilon versions 1.1 through 1.1.1 ipsilon versions 1.2 through 1.2.0 ipsilon versions 2.0 through 2.0.1 **Description** A issue was found that allows an attacker to log out active sessions of other users. This is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also referred to as a "SAML2 multi-session" issue. **Recommendations** For ipsilon versions 1.0 through 1.0.2, update to version 1.0.3 or later. For ipsilon versions 1.1 through 1.1.1, update to version 1.1.2 or later. For ipsilon versions 1.2 through 1.2.0, update to version 1.2.1 or later. For ipsilon versions 2.0 through 2.0.1, update to version 2.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** TGCaptcha2 version 0.3.0 **Description** The issue is related to a missing nonce, which enables attackers to reuse a single solved CAPTCHA multiple times, effectively bypassing the CAPTCHA's security mechanism. **Recommendations** For TGCaptcha2 version 0.3.0, consider implementing a nonce to prevent replay attacks until a patch is available. As a temporary workaround, restrict the use of the CAPTCHA mechanism to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ipsilon versions 0.1.0 through 1.0.0 **Description** The issue is related to the Identity Provider (IdP) server, where the `providers/saml2/admin.py` file does not properly check permissions to update the SAML2 Service Provider (SP) owner. This allows remote authenticated users to cause a denial of service via a duplicate SP name. **Recommendations** For Ipsilon versions 0.1.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1 **Description** The issue is related to improper permission checking in the `providers/saml2/admin.py` file of the Identity Provider (IdP) server. This allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP). **Recommendations** For Ipsilon versions 0.1.0 through 1.0.1, update to version 1.0.2 or later. For Ipsilon versions 1.1.x prior to 1.1.1, update to version 1.1.1 or later.