CVE-2019-19191: Improper Link Resolution Before File Access

Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account after installation. This allows the user to escalate to root by pointing symlinks to files such as /etc/shadow...

CVE-2015-2684: Improper Input Validation

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...