226 matches found
Debian dla-3485 : php-cas - security update
"The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3485 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3485-1 [email protected] https://www.debian.org/lts/security/...
Credentials Leaks
cas-server-support-x509-core is vulnerable to Credentials Leaks. The vulnerability exists because the prepareConnectionFactory function of LdaptiveResourceCRLFetcher.java does not properly validate the ldapURL parameter provided by the certificate, leaking the credentials for LDAP authentication ...
org.jasig.cas:cas-management-webapp (>=4.0.0-rc1, <=4.0.7), org.jasig.cas:cas-server-webapp (>=3.5.1-rc1, <=3.6.0) potentially affected by CVE-2023-34613 via net.sf.sojo:sojo (1.0.5)
net.sf.sojo:sojo MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.sojo:sojo and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc1, =3.5.1-rc1, =3.6.0 Source cves: CVE-2023-34613 Source advisory:...
org.jasig.cas:cas-management-webapp (>=4.0.0-rc1, <=4.0.7), org.jasig.cas:cas-server-webapp (>=3.5.1-rc1, <=3.6.0) potentially affected by CVE-2023-34613 via net.sf.sojo:sojo (1.0.5)
net.sf.sojo:sojo MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.sojo:sojo and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc1, =3.5.1-rc1, =3.6.0 Source cves: CVE-2023-34613 Source advisory:...
org.apereo.cas:cas-server-core-configuration-cloud-vault (5.2.0-rc1) potentially affected by CVE-2023-20859 via org.springframework.vault:spring-vault-core (1.0.1.release)
org.springframework.vault:spring-vault-core MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.vault:spring-vault-core and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-vault 5.2.0-rc...
com.atomgraph:linkeddatahub (>=4.0.0, <=5.4.0), org.apache.tomcat:tomcat-catalina (>=10.1.0-m1, <=10.1.4) +6 more potentially affected by CVE-2023-24998 via org.apache.tomcat:tomcat-coyote (>=10.1.0-m1, <=10.1.4)
org.apache.tomcat:tomcat-coyote MAVEN version =10.1.0-m1, =4.0.0, =10.1.0-m1, =10.1.0-m1, =10.1.0-m1, =17.0.0.final, =17.0.0.final, =17.0.1.final Source cves: CVE-2023-24998 Source advisory: GHSA-HFRX-6QGJ-FP6C...
GHSA-8Q72-6QQ8-XV64 phpCAS vulnerable to Service Hostname Discovery Exploitation
Impact The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm CAS server to authenticate to the service protected by phpCAS...
Design/Logic Flaw
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-39369
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-39369
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-39369
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-39369 Service Hostname Discovery Exploitation in phpCAS
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
phpCAS vulnerable to Service Hostname Discovery Exploitation
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
CVE-2022-39369 Service Hostname Discovery Exploitation in phpCAS
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service CAS server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a...
io.gravitee.gateway.standalone:gravitee-gateway-standalone-container (>=0.2.0, <=0.7.0), io.gravitee.gateway.standalone:gravitee-gateway-standalone-distribution (>=0.2.0, <=0.7.0) +12 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.7.2.release)
org.springframework.data:spring-data-mongodb MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: -...
org.apereo.cas:cas-mgmt-api-configuration (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-mgmt-core-util (>=6.0.0-rc4, <=6.1.0-rc4) +197 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (>=6.0.0-rc4, <=6.1.0-rc4)
org.apereo.cas:cas-server-core-services-api MAVEN version =6.0.0-rc4, =6.1.0-rc2, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.1.0-rc4 and more Source cves: CVE-2019-10754...
org.apereo.cas:cas-server-core (5.3.0), org.apereo.cas:cas-server-core-logout (5.3.0) +155 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.3.0)
org.apereo.cas:cas-server-core-services-api MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.3.0 -...
org.apereo.cas:cas-server-core (5.2.5), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.5) +132 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.2.5)
org.apereo.cas:cas-server-core-services-api MAVEN version 5.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.2.5 -...
org.apereo.cas:cas-management-webapp-support (5.3.0-rc3) potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.3.0-rc3)
org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.3.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-management-webapp-support...
org.apereo.cas:cas-management-webapp-configuration (5.3.1), org.apereo.cas:cas-management-webapp-support (5.3.1) +158 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.3.1)
org.apereo.cas:cas-server-core-services-api MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-management-webapp-configuration 5.3.1 -...