Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
shibboleth vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2018-0486
Shibboleth XMLTooling-C prior to 1.6.3, as used in Shibboleth Service Provider prior to 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote malicious users to obtain sensitive information or conduct impersonation attacks ...
Shibboleth Xmltooling-c
Debian Debian Linux 8.0
Debian Debian Linux 7.0
Debian Debian Linux 9.0
8.1
CVSSv3
CVE-2017-16852
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider prior to 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforc...
Shibboleth Service Provider
Debian Debian Linux 8.0
Debian Debian Linux 9.0
8.1
CVSSv3
CVE-2017-16853
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML prior to 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enfo...
Shibboleth Opensaml
Debian Debian Linux 8.0
Debian Debian Linux 9.0
6.1
CVSSv3
CVE-2017-14313
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin prior to 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().
Shibboleth Project Shibboleth
NA
CVE-2015-5513
Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x prior to 6.x-4.2 and 7.x-4.x prior to 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspeci...
Niif Shibboleth Authentication 6.x-4.1
Niif Shibboleth Authentication 6.x-4.2rc1
Niif Shibboleth Authentication 7.x-4.0
Niif Shibboleth Authentication 7.x-4.1
Niif Shibboleth Authentication 6.x-4.0
Niif Shibboleth Authentication 7.x-4.2
NA
CVE-2015-0851
XMLTooling-C prior to 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote malicious users to cause a denial of service (crash) via schema-invalid XML data.
Xmltooling Project Xmltooling
NA
CVE-2015-1796
The PKIX trust engines in Shibboleth Identity Provider prior to 2.4.4 and OpenSAML Java (OpenSAML-J) prior to 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote malicious users to impersonate an entity via a certifica...
Shibboleth Identity Provider
Shibboleth Opensaml Java
NA
CVE-2015-0218
Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle up to and including 2.5.9, 2.6.x prior to 2.6.7, 2.7.x prior to 2.7.4, and 2.8.x prior to 2.8.2 allows remote malicious users to hijack the authentication of arbitrary users for requests that ...
Moodle Moodle
Moodle Moodle 2.6.2
Moodle Moodle 2.6.1
Moodle Moodle 2.6.0
Moodle Moodle 2.7.3
Moodle Moodle 2.5.4
Moodle Moodle 2.5.3
Moodle Moodle 2.5.2
Moodle Moodle 2.5.1
Moodle Moodle 2.5.8
Moodle Moodle 2.5.6
Moodle Moodle 2.6.6
Moodle Moodle 2.6.4
Moodle Moodle 2.7.1
Moodle Moodle 2.8.0
Moodle Moodle 2.5.7
Moodle Moodle 2.5.5
Moodle Moodle 2.5.0
Moodle Moodle 2.6.5
Moodle Moodle 2.6.3
Moodle Moodle 2.7.2
Moodle Moodle 2.7.0
NA
CVE-2015-3375
Cross-site request forgery (CSRF) vulnerability in the Shibboleth Authentication module prior to 6.x-4.1 and 7.x-4.x prior to 7.x-4.1 for Drupal allows remote malicious users to hijack the authentication of administrators for requests that delete user role matching rules via unsp...
Niif Shibboleth Authentication 7.x-4.0
Niif Shibboleth Authentication
NA
CVE-2015-2684
Shibboleth Service Provider (SP) prior to 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.
Shibboleth Service Provider
Debian Debian Linux 7.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »