Updated php-pear-CAS packages fix CVE-2014-4172

Updated php-pear-CAS packages fix security vulnerabilities: A flaw in php-pear-CAS before 1.3.3, utilized by Moodle, has been found which could potentially allow unauthorised access and privilege escalation CVE-2014-4172...

PT-2020-7671

Name of the Vulnerable Software and Affected Versions Jasig Java CAS Client versions prior to 3.3.2 .NET CAS Client versions prior to 1.0.2 phpCAS versions prior to 1.3.3 Description A URL parameter injection issue was found in the CAS protocol, specifically in the back-channel ticket validation...

Debian DSA-3017-1 : php-cas - security update

Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

[SECURITY] [DSA 3017-1] php-cas security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3017-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 2, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 3017-1 (php-cas - security update)

Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting. OpenVAS Vulnerability Test $Id: deb3017.nasl 6692 2017-07-12 09:57:43Z teissa $ Auto-generated...

Debian: Security Advisory (DSA-3017-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for cas-client FEDORA-2014-9662

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 20 Update: cas-client-3.3.3-1.fc20

Jasig CAS Client for Java is the integration point for applications that want to speak with a CAS server, either via the CAS 1.0 or CAS 2.0 protocol...

Fedora 20 : cas-client-3.3.3-1.fc20 (2014-9662)

update to 3.3.3 - fix CVE-2014-4172 rhbz1131371 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

CVE-2014-2565

The CVE-2014-2565 entry concerns Blue Coat Content Analysis System (CAS) 1.1 prior to 1.1.4.2, where the command line interface can be abused by remote administrators to execute arbitrary commands via unspecified vectors (command injection). Affected component: CAS CLI in version 1.1.x before 1.1...

PT-2014-4781

Name of the Vulnerable Software and Affected Versions Blue Coat Content Analysis System CAS versions 1.1 through 1.1.4.1 Description The command-line interface in the affected system allows remote administrators to execute arbitrary commands via unspecified vectors, related to command injection...

SA-CONTRIB-2014-035 - CAS Server - Access Bypass

The casserver module of the CAS project implements the CAS 1.0 and 2.0 specifications for providing a single sign-on to relying party web application the "service" in CAS specs. The CAS server creates single-use tickets when serving a user's login request, which is subsequently deleted when the...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2014-0050 via commons-fileupload:commons-fileupload (>=1.0, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2014-0050 Source advisory: MEND:CVE-2014-0050...

CVE-2009-5138

GnuTLS before 2.7.6, when the GNUTLSVERIFYALLOWX509V1CACRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different...

CVE-2009-5138

GnuTLS before 2.7.6, when the GNUTLSVERIFYALLOWX509V1CACRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different...

SuSE 11.3 Security Update : openssl-certs (SAT Patch Number 8924)

The openssl-certs package was updated to match the certificates contained in the Mozilla NSS 3.15.4 release. Following changes were done to the list of root CAs : - Added: ACCVRAIZ1.pem Spain all trusts - Added: SGTRUSTSERVICESRACINE.pem Singapore email signing only - Added: TWCAGlobalRootCA.pem...

Fixing Trust Through Certificate Transparency

SAN FRANCISCO–The security of data being transmitted over the Web relies on a large number of moving parts, from the integrity of the machine sending the data, to the security of the browser, to the implementation of encryption, to the fragility of the certificate authority system. Experts have...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.3), ai.databand.azkaban:azkaban-common (3.18.0) +5128 more potentially affected by CVE-2013-2186 via commons-fileupload:commons-fileupload (>=1.0, <=1.3)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =1.0, =3.1.1, =3.1.3 and more Source cves: CVE-2013-2186 Source advisory: MEND:CVE-2013-2186...

CVE-2013-2716

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file casclientconfig.yml when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie...

Code injection

Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file casclientconfig.yml when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie...