226 matches found
org.jasig.cas:cas-server-support-pac4j (>=4.2.0-rc1, <=4.2.1), org.jasig.cas:cas-server-support-pac4j-webflow (>=4.2.0-rc1, <=4.2.1) +1 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.8.2)
org.pac4j:pac4j-saml MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.jasig.cas:cas-server-support-pac4j =4.2.0-rc1, =4.2.0-rc1, =4.2.1 - org.pac4j:pac4j-config 1.8.2 Source cves:...
org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.2.0-rc2, <=5.3.3) +271 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (>=v6.4.0-rc5, <=6.1.0-rc4)
org.apereo.cas:cas-server-core-services-api MAVEN version =v6.4.0-rc5, =5.3.1, =5.2.0-rc2, =5.3.1, =6.1.0-rc2, =6.0.0-rc4, =6.0.0-rc4, =v6.4.0-rc5, =v6.4.0-rc5, =v6.4.0-rc5, =v6.4.0-rc5, =5.2.0-rc2, =v6.4.0-rc5, =v6.4.0-rc5, =5.3.0-rc2, =v6.4.0-rc5, =6.1.0-rc4 and more Source cves: CVE-2019-10754...
org.apereo.cas:cas-server-support-oauth (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-server-support-oauth-core (>=6.1.0-rc2, <=6.1.0-rc4) +5 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-support-oauth-core-api (>=6.1.0-rc2, <=6.1.0-rc4)
org.apereo.cas:cas-server-support-oauth-core-api MAVEN version =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc4 Source cves: CVE-2019-10754 Source advisory: MEND:CVE-2019-10754...
Insecure Randomness
Overview org.apereo.cas:cas-server-support-shell is a package for the CAS command-line shell provides the ability to query the CAS server for help on available settings/modules and various other utility functions. Affected versions of this package are vulnerable to Insecure Randomness. A insecure...
Insecure Randomness
Overview org.apereo.cas:cas-server-support-oauth-core-api is a CAS Server Support OAuth Core API for supporting OAuth within Apereo CAS. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it reli...
org.apereo.cas:cas-server-support-oauth (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-server-support-oauth-core (>=6.1.0-rc2, <=6.1.0-rc4) +5 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-support-oauth-core-api (>=6.1.0-rc2, <=6.1.0-rc4)
org.apereo.cas:cas-server-support-oauth-core-api MAVEN version =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc4 Source cves: CVE-2019-10754 Source advisory: SNYK:JAVA-ORGAPEREOCAS-467406...
org.jasig.cas:cas-server-webapp (>=3.5.0-rc1, <=3.6.0) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.0.release)
org.springframework.security:spring-security-cas MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-server-webapp =3.5.0-rc1, =3.6.0 Sour...
Cross-site Scripting (XSS)
cas-server-webapp is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as the security questions in casResetPasswordVerifyQuestionsView.html can contain html tags and have lack of sanitization, allowing XSS attacks...
CVE-2014-2296
The CVE-2014-2296 issue affects Jasig CAS Server, specifically the SamlUtils.java XML processing path. Affected versions are CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled. The vulnerability is an XML External Entity (XXE) flaw that allows remote ...
CVE-2014-2296: Improper Restriction of XML External Entity Reference
XML external entity XXE vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data...
PT-2018-4196
Name of the Vulnerable Software and Affected Versions Jasig CAS server versions prior to 3.4.12.1 Jasig CAS server versions 3.5.x prior to 3.5.2.1 Description The issue allows remote unauthenticated users to bypass authentication via crafted XML data when Google Accounts Integration is enabled...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
Authentication flaw
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
UBUNTU-CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CVE-2017-1000071: Improper Authentication
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CAS - Moderately Critical - Information Disclosure - DRUPAL-SA-CONTRIB-2016-005
This module enables you to use your Drupal site as a client or server for the single sign on protocol CAS. This vulnerability only affects sites that use the "CAS Server" sub module. The module doesn't allow an administrator to restrict which CAS clients are allowed authenticate with the Drupal C...
CVE-2015-1169
Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...
CVE-2015-1169: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Apereo Central Authentication Service CAS Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication...