Fedora 28 : php-pear-CAS (2018-0bc91454ce)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

MGASA-2018-0452 Updated php-pear-CAS packages fix security vulnerabilities

Updated php-pear-CAS packages fix security vulnerabilities: An XSS vulnerabilities has been fixed for proxy mode...

Updated php-pear-CAS packages fix security vulnerabilities

Updated php-pear-CAS packages fix security vulnerabilities: An XSS vulnerabilities has been fixed for proxy mode...

Race condition

In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1...

CVE-2018-9539

In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1...

CVE-2018-9539

CVE-2018-9539 is a local elevation-of-privilege in the Android ClearKey CAS descrambler caused by a use-after-free race condition. Affects Android 8.0–9; exploitation requires local access with no user interaction. The Android Security Bulletin indicates patches at the 2018-11-01/2018-11-05 patch...

CVE-2018-9539

In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1...

CVE-2018-9539: Concurrent Execution using Shared Resource with Improper Synchronization

In the ClearKey CAS descrambler, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1...

Fedora Update for php-pear-CAS FEDORA-2018-95695b59c7

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for php-pear-CAS FEDORA-2018-0bc91454ce

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: php-pear-CAS-1.3.6-1.fc27

This package is a PEAR library for using a Central Authentication Service. Autoloader '%pearphpdir/CAS/Autoload.php';...

[SECURITY] Fedora 28 Update: php-pear-CAS-1.3.6-1.fc28

This package is a PEAR library for using a Central Authentication Service. Autoloader '%pearphpdir/CAS/Autoload.php';...

Fedora 27 : php-pear-CAS (2018-95695b59c7)

Version 1.3.6 Security Fixes: - Fix XSS in proxy mode 271 Joachim Fritschi Bug Fixes: - Fix bad condition 252 Brice Vercoustre - Hash ticket strings to generate valid-length session-ids 224, 244, 248 Adam Franco - Fix 'phpCAS' class capitalization in code 273, 277 phy25 Improvement: - Remove...

Amcrest Cameras SSL Key Reuse Across installations

Unpacking the firmware of any given 4 tested Amcrest Camera shows that they use the same SSL Keys. For example, on the AmcrestIPC-HX1X3X-LEXUSEngNAMCRESTV2.420.AC01.3.R.20180206 firware we can see hard coded SSL private keys and CAs. If we run binwalk we can see this in the folder...

CVE-2017-2590

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of servic...

CVE-2017-2590

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of servic...

XML External Entity (XXE)

Jasig CAS Client is vulnerable to XML External Entity XXE injection. The attacker can trigger the attack by sending malicious XML data because it does not prevent loading malicious XML data via java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server when Google Accounts Integration is on...

Xxe

XML external entity XXE vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data...

CVE-2014-2296

XML external entity XXE vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data...

CVE-2014-2296

The CVE-2014-2296 issue affects Jasig CAS Server, specifically the SamlUtils.java XML processing path. Affected versions are CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled. The vulnerability is an XML External Entity (XXE) flaw that allows remote ...