CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

org.apereo.cas:cas-server-support-oauth (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-server-support-oauth-core (>=6.1.0-rc2, <=6.1.0-rc4) +5 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-support-oauth-core-api (>=6.1.0-rc2, <=6.1.0-rc4)

org.apereo.cas:cas-server-support-oauth-core-api MAVEN version =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc4 Source cves: CVE-2019-10754 Source advisory: MEND:CVE-2019-10754...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2019-10199 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

PT-2019-12028

Name of the Vulnerable Software and Affected Versions Apereo CAS versions prior to 6.1.0-RC5 Description The issue arises from the use of apache commons-lang3 RandomStringUtils for token and ID generation in multiple classes within Apereo CAS. This makes the generated tokens and IDs predictable d...

CVE-2019-10754: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

Apereo CAS Security Feature Issue Vulnerability

Apereo CAS is a web-based enterprise multilingual single sign-on solution. A security feature issue vulnerability exists in Apereo CAS versions prior to 6.1.0-RC5, which stems from a poorly encrypted algorithm in the RandomStringUtils PRNG, and can be exploited by an attacker to infer generated...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.3.1, <=5.3.3) +232 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=3.0.0-rc2, <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =3.0.0-rc2, =5.3.1, =5.3.1, =5.3.1, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.3 and more Source cves: CVE-2019-10755 Source advisory: SNYK:JAVA-ORGPAC4J-467407...

Insecure Randomness

Overview org.apereo.cas:cas-server-support-oidc is a package that allows allows CAS to act as an OpenId Connect Provider OP. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it relies upon apac...

Insecure Randomness

Overview org.apereo.cas:cas-server-support-shell is a package for the CAS command-line shell provides the ability to query the CAS server for help on available settings/modules and various other utility functions. Affected versions of this package are vulnerable to Insecure Randomness. A insecure...

Insecure Randomness

Overview org.apereo.cas:cas-server-support-oauth-core-api is a CAS Server Support OAuth Core API for supporting OAuth within Apereo CAS. Affected versions of this package are vulnerable to Insecure Randomness. A insecure source of randomness is used to generate all of its random values as it reli...

org.apereo.cas:cas-server-support-oauth (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-server-support-oauth-core (>=6.1.0-rc2, <=6.1.0-rc4) +5 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-support-oauth-core-api (>=6.1.0-rc2, <=6.1.0-rc4)

org.apereo.cas:cas-server-support-oauth-core-api MAVEN version =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc2, =6.1.0-rc4 Source cves: CVE-2019-10754 Source advisory: SNYK:JAVA-ORGAPEREOCAS-467406...

CVE-2019-3754

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could...

PT-2019-16694

Name of the Vulnerable Software and Affected Versions Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116 Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 Dell EMC VNXe3200 versions prior to 3.1.10.9946299 Description The issue is related to a reflected cross-site scripting...

CVE-2019-3754: Improper Neutralization of Input During Web Page Generation

Dell EMC Unity Operating Environment versions prior to 5.0.0.0.5.116, Dell EMC UnityVSA versions prior to 5.0.0.0.5.116 and Dell EMC VNXe3200 versions prior to 3.1.10.9946299 contain a reflected cross-site scripting vulnerability on the cas/logout page. A remote unauthenticated attacker could...

Firefox to Automatically Trust OS-Installed CA Certificates to Prevent TLS Errors

Mozilla has finally introduced a mechanism to let Firefox browser automatically fix certain TLS errors, often triggered when antivirus software installed on a system tries to intercept secure HTTPS connections. Most Antivirus software offers web security feature that intercepts encrypted HTTPS...

org.jasig.cas:cas-server-webapp (>=3.5.0-rc1, <=3.6.0) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-server-webapp =3.5.0-rc1, =3.6.0 Sour...

org.jasig.cas:cas-management-webapp (>=4.0.0-rc4, <=4.0.7) potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.0.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc4, =4.0.7...

com.vnomicscorp:spring-stateless-ticket-cache-redis (1.0.3), org.eobjects.datacleaner:datacleaner-monitor-completeness-analysis-wizard (>=4.0-rc5, <=4.0.9) +10 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.5.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - com.vnomicscorp:spring-stateless-ticket-cache-redis 1.0...

mil.navy.spawar.soaf:soaf-generic-security-module (1.0.0), mil.navy.spawar.soaf:soaf-parent (>=1.0.0, <=1.0.3) +17 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.2.7.release)

org.springframework.security:spring-security-cas MAVEN version 3.2.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - mil.navy.spawar.soaf:soaf-generic-security-module 1.0.0...

net.unicon.cas:cas-addons (>=1.1-rc1, <=1.7), net.unicon.cas:cas-java-clients-addons (0.5) +12 more potentially affected by CVE-2019-11272 via org.springframework.security:spring-security-cas (3.1.3.release)

org.springframework.security:spring-security-cas MAVEN version 3.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-cas and may be impacted: - net.unicon.cas:cas-addons =1.1-rc1, =3.5-rc1, =3.5-rc1,...