PT-2019-15778

Name of the Vulnerable Software and Affected Versions Shibboleth Service Provider SP versions 3.x before 3.1.0 Description The issue allows a user to escalate to root by pointing symlinks to sensitive files, such as /etc/shadow, due to a spec file that calls chown on files in a directory controll...

CVE-2019-19191: Improper Link Resolution Before File Access

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

PT-2015-4918

Name of the Vulnerable Software and Affected Versions XMLTooling-C versions prior to 1.5.5 OpenSAML-C affected versions not specified Shibboleth Service Provider SP affected versions not specified Description The issue allows remote attackers to cause a denial of service, resulting in a crash, by...

CVE-2015-2684: Improper Input Validation

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...