com.github.dblock.waffle:waffle-spring-security2 (>=1.7, <=1.7.5), com.googlecode.cedar-common:cedar-common-gae (>=2.1.3, <=5.8.4) +12 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (2.0.8.release)

org.springframework.security:spring-security-core MAVEN version 2.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.github.dblock.waffle:waffle-spring-security2 =1.7...

com.payneteasy.superfly:superfly-web (>=1.2-1, <=1.4-3), org.codehaus.enunciate:enunciate-spring3-security-rt (>=1.20, <=1.22) +15 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.0.2.release)

org.springframework.security:spring-security-core MAVEN version 3.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - com.payneteasy.superfly:superfly-web =1.2-1, =1.20,...

org.ff4j:ff4j-security-spring (>=1.0.0, <=1.1.0), org.springframework.security:spring-security-acl (3.0.8.release) +7 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (3.0.8.release)

org.springframework.security:spring-security-core MAVEN version 3.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.ff4j:ff4j-security-spring =1.0.0, =1.1.0 -...

org.apache.ranger:ranger-kylin-plugin (>=2.3.0, <=2.4.0), org.apache.ranger:ranger-kylin-plugin-shim (>=2.3.0, <=2.4.0) +12 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.14.release)

org.springframework.security:spring-security-core MAVEN version 4.2.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.apache.ranger:ranger-kylin-plugin =2.3.0, =2.3.0...

ugn.cas.cz Cross Site Scripting vulnerability OBB-3861672

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

org.acegisecurity:acegi-security-cas (>=1.0.5, <=1.0.7), org.acegisecurity:acegi-security-samples-contacts (1.0.7) +4 more potentially affected by CVE-2024-22243 via org.springframework:spring-web (1.2.9)

org.springframework:spring-web MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security-cas =1.0.5, =1.0.7 -...

com.buession.cas:buession-cas-session (>=2.3.0, <=2.3.2), com.buession.cas:buession-cas-session-hazelcast (>=2.3.0, <=2.3.2) +19 more potentially affected by CVE-2023-45860 via com.hazelcast:hazelcast (4.1.10)

com.hazelcast:hazelcast MAVEN version 4.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.buession.cas:buession-cas-session =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =3.15.17,...

CVE-2024-25618

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers CAS, SAML, OIDC to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication...

CVE-2024-25618: Improper Authentication

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows new identities from configured authentication providers CAS, SAML, OIDC to attach to existing local users with the same e-mail address. This results in a possible account takeover if the authentication...

Moderate: Red Hat Security Advisory: Red Hat Certificate System 10.4 for RHEL 8 security and bug fix update

An update is now available for Red Hat Certificate System 10.4 for RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

org.apereo.cas:cas-mgmt-api-configuration (6.0.0-rc4), org.apereo.cas:cas-mgmt-core-util (6.0.0-rc4) +270 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (6.4.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 6.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apereo.cas:cas-mgmt-api-configuration 6.0.0-rc4 - org.apereo.cas:cas-mgmt-core-util 6.0.0-rc4 -...

com.cybersource:authenticationsdk (>=0.0.1, <=0.0.5), com.cybersource:cybersource-rest-client-java (>=0.0.1, <=0.0.12) +74 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.22)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.cybersource:authenticationsdk =0.0.1, =0.0.1, =0.0.12 - com.github.javadev:authenticationsdk 0.0.5 -...

org.apereo.cas:cas-management-webapp-support (>=5.1.0-rc4, <=5.1.9), org.apereo.cas:cas-management-webapp-support-ldap (>=5.1.0-rc4, <=5.1.9) +124 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (4.36)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.36 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apereo.cas:cas-management-webapp-support =5.1.0-rc4, =5.1.0-rc4, =5.1.0-rc4, =5.1.0-rc4, =5.1.0-rc4,...

com.authlete:authlete-jose (>=1.1, <=1.2), com.buession.cas:buession-cas-core (>=1.1.0, <=1.1.2) +343 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (8.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.authlete:authlete-jose =1.1, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =2.4.0, =2.6.8 -...

be.atbash.ee.security:octopus-cas (0.6), be.atbash.ee.security:octopus-cas-se (0.6) +55 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (6.3)

com.nimbusds:nimbus-jose-jwt MAVEN version 6.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - be.atbash.ee.security:octopus-cas 0.6 - be.atbash.ee.security:octopus-cas-se 0.6 -...

com.buession.cas:buession-cas-core (>=1.2.1, <=1.3.2), com.buession.cas:buession-cas-metrics (>=1.2.1, <=1.3.2) +361 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (8.17.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 8.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - com.buession.cas:buession-cas-core =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.2.1, =1.24.2,...

Malware in ent-cas-services

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in eslint-plugin-cas

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-919 Malicious code in eslint-plugin-cas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d34434c25cc547fc15a7c3f59fb63cd2697250ac930ac08f8ee019657417dc3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-cas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d34434c25cc547fc15a7c3f59fb63cd2697250ac930ac08f8ee019657417dc3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...