1745 matches found
SQL Injection
cas-catalog is vulnerable to SQL injection. The vulnerability is possible because it does not sanitize user-provided input for SQL commands, allowing attackers to inject malicious SQL commands leading to the leakage of sensitive information...
Authentication Bypass
apereo/phpCAS is vulnerable to authentication bypass. The bypass happens because it does not check the authentication of XML tag in the ticke while validating a CAS 2.0 ST or PT in validateCAS20 function of source/CAS/Client.php...
MGASA-2017-0293 Updated php-pear-CAS package fixes security vulnerability
It was discovered that php-pear-CAS contained a possible authentication bypass in validateCAS20...
Updated php-pear-CAS package fixes security vulnerability
It was discovered that php-pear-CAS contained a possible authentication bypass in validateCAS20...
PT-2017-19435
Name of the Vulnerable Software and Affected Versions php-pear-CAS affected versions not specified Description A possible authentication bypass was discovered in the validateCAS20 function of php-pear-CAS. Recommendations At the moment, there is no information about a newer version that contains ...
Authentication Bypass
phpCAS is vulnerable to authentication bypasses. When authenticating against older CAS servers, a malicious user can bypass authentication by injecting xml tags into the ticket...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
UBUNTU-CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
Authentication flaw
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
Fedora 26 : php-pear-CAS (2017-2f3096ba16)
Changes in version 1.3.5 - Security Fixes : - Fix possible authentication bypass in validateCAS20 228 Gregory Boddin - Bug Fixes : - Fix file permissions non-executable 177 Remi Collet - Fixed translations Greek and Japanese 192 ikari7789 - Fix errors under phpdbg 204 MasonM - Fix logout...
CVE-2017-1000071: Improper Authentication
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
Credential Sniffing
Moodle is vulnerable to credential sniffing. The multi-authentication feature in the Central Authentication Service cas of Moodle doesn't use HTTPS, allowing attackers to find credentials by sniffing the network...
CVE-2014-3527
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...
CVE-2014-3527
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...
Design/Logic Flaw
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...
CVE-2014-3527
The CVE-2014-3527 issue affects Spring Security’s CAS Proxy ticket authentication (versions 3.1 to 3.2.4). The root cause is that the proxy ticket authentication relies on HttpServletRequest data that can be populated from untrusted information, enabling a malicious CAS service to bypass access c...
CVE-2014-3527
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...
CVE-2014-3527
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the...