THREATIST.IORead the docs 4 records
FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.
FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xml.parsers.DocumentBuilderFactory unsafely.
FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack".
An issue was discovered in FusionAuth before 1.11.0.