CVE-2023-36661
Published Jun 25, 2023Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Serv…
Vendor archive
shibboleth CVEs
Beta · best-effort18 CVEs tagged to vendor shibboleth — 0 Critical, 9 High, 9 Medium, 0 Low, 0 Unrated.
CVE-2023-22947
Published Jan 11, 2023Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM…
CVE-2022-24129
Published Feb 4, 2022The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allow…
CVE-2021-31826
Published Apr 27, 2021Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on sy…
CVE-2021-28963
Published Mar 22, 2021Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
CVE-2020-27978
Published Oct 28, 2020Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the cre…
CVE-2019-19191
Published Nov 21, 2019Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installatio…
CVE-2010-2450
Published Nov 7, 2019The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the…
CVE-2014-3603
Published Apr 4, 2019The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostna…
CVE-2018-0489
Published Feb 27, 2018Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows…
- evidence mentions
- 1
- Buzz score
- 11.9
CVE-2018-0486
Published Jan 13, 2018Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, whic…
CVE-2017-16853
Published Nov 16, 2017The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the Metada…
CVE-2017-16852
Published Nov 16, 2017shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the Metadata…
CVE-2015-1796
Published Jul 8, 2015The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are availab…
CVE-2015-2684
Published Mar 31, 2015Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message.
CVE-2013-6440
Published Feb 14, 2014The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to t…
CVE-2011-1411
Published Sep 2, 2011Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signat…
CVE-2011-2516
Published Jul 11, 2011Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to caus…
Showing 1-18 of 18 CVEsPage 1 of 1