PT-2025-45690

A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6webapp-mgmtcas-management-webapp-supportsrcmainjavaorgapereocasmgmtserviceswebManageRegisteredServicesMultiActionController.java. The manipulation of...

CVE-2025-3985: Inefficient Regular Expression Complexity

A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The...

Apereo CAS 安全漏洞

Apereo CAS is a web-based enterprise multilingual single sign-on solution from Apereo open source. A security vulnerability exists in Apereo CAS version 5.2.6, which originates from the file cas-5.2.6corecas-server-core-configuration-metadata-repositorysrcmainjavaorgapereocasmetadata Parameter Na...

PT-2025-18017

Name of the Vulnerable Software and Affected Versions Apereo CAS version 5.2.6 Description A vulnerability was found in the software, affecting the CasConfigurationMetadataServerController.java file. The manipulation of the Name argument leads to inefficient regular expression complexity, allowin...

CVE-2025-30561

Cross-Site Request Forgery CSRF vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through = 1.1.3...

CVE-2025-30561

Cross-Site Request Forgery CSRF vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through = 1.1.3...

CVE-2025-30561 WordPress CAS Maestro plugin <= 1.1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Henrique Mouta CAS Maestro allows Stored XSS. This issue affects CAS Maestro: from n/a through 1.1.3...

CVE-2025-30561

CVE-2025-30561: In CAS Maestro, a CSRF can lead to stored XSS in versions up to 1.1.3. The Wordfence vulnerability listing confirms the affected product/version and notes the patch status as pending/unpatched; no specific remediation (patch version) is provided in the available documents. Monitor...

WordPress CAS Maestro plugin <= 1.1.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin CAS Maestro versions = 1.1.3...

WordPress plugin CAS Maestro 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2025-30561: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through = 1.1.3...

PT-2025-12609

Name of the Vulnerable Software and Affected Versions Henrique Mouta CAS Maestro versions 1.1.3 and earlier Description The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations For versions 1.1.3 and earlier, update to a version that contains a fix for...

checkstyle:CheckstyleFuzzer: Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

Project: https://github.com/checkstyle/checkstyle.git Detailed Report: https://oss-fuzz.com/testcase?key=4616196435804160 Project: checkstyle Fuzzing Engine: libFuzzer Fuzz Target: CheckstyleFuzzer Job Type: libfuzzerasancheckstyle Platform Id: linux Crash Type: Security exception Crash Address:...

Linux Distros Unpatched Vulnerability : CVE-2014-4172

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS...

GHSA-527C-RV7J-WXGP vulnerabilities

Vulnerabilities for packages: openjdk-26-openj9, openjdk-8-openj9, openjdk-17-openj9, openjdk-11-openj9, openjdk-21-openj9, openjdk-25-openj9...

PT-2025-54882

This update for ca-certificates-mozilla fixes the following issues: - Updated to 2.68 state of Mozilla SSL root CAs bsc1227525 - Added: FIRMAPROFESIONAL CA ROOT-A WEB - Distrust: GLOBALTRUST 2020 - Updated to 2.66 state of Mozilla SSL root CAs bsc1220356 Added: - CommScope Public Trust ECC Root-0...

Cross-site Scripting (XSS)

Overview collaborative-article-sharing is a Command-line interface for interacting with the CAS API Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing validations of the redirectUri parameter. Details A cross-site scripting attack occurs when the attacker...

PT-2024-17651

Name of the Vulnerable Software and Affected Versions Peter’s Custom Anti-Spam plugin for WordPress versions up to, and including, 3.2.3 Description The issue is due to missing nonce validation on the cas register post function, making it possible for unauthenticated attackers to blacklist emails...

WordPress plugin Peter’s Custom Anti-Spam 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

CVE-2018-9411

In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation...