Vendor/product archive

shibboleth / identity_provider CVEs

Beta · best-effort

3 CVEs tagged to shibboleth / identity_provider — 0 Critical, 1 High, 2 Medium, 0 Low, 0 Unrated.

See this archive with more filters Back to shibboleth vendor archive

CVE-2020-27978

Published Oct 28, 2020

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the cre…

CVSS 7.5 · High

Vendor/product tagsBeta · best-effort

CVE-2014-3603

Published Apr 4, 2019

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostna…

CVSS 5.9 · Medium

Vendor/product tagsBeta · best-effort

CVE-2015-1796

Published Jul 8, 2015

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are availab…

CVSS 4.3 · Medium

Vendor/product tagsBeta · best-effort

Showing 1-3 of 3 CVEsPage 1 of 1