Linux Distros Unpatched Vulnerability : CVE-2021-20187

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP...

Linux Distros Unpatched Vulnerability : CVE-2021-36394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. CVE-2021-36394 Note that Nessus relies on the presence of the...

Shibboleth Service Provider 安全漏洞

Shibboleth Service Provider is a single sign-on framework from Shibboleth UK. A security vulnerability exists in Shibboleth Service Provider 3.5.0 and earlier versions, which stems from a SQL injection in the ID attribute of a SAML response, which could lead to the disclosure of database...

CVE-2025-9943: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing f...

Debian: Security Advisory (DSA-5994-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5994-1] shibboleth-sp security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5994-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 07, 2025 https://www.debian.org/security/faq -...

Debian dsa-5994 : libapache2-mod-shib - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-5994 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5994-1 [email protected] https://www.debian.org/security/...

DSA-5994-1 shibboleth-sp - security update

Bulletin has no description...

PT-2025-37025

Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider versions through 3.5.0 Description: An SQL injection vulnerability exists in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database ...

FreeBSD : Shibboleth Service Provider -- SQL injection vulnerability in ODBC plugin (9f9b0b37-88fa-11f0-90a2-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9f9b0b37-88fa-11f0-90a2-6cc21735f730 advisory. Internet2 reports: The Shibboleth Service Provider includes a storage API usable for a number of...

Shibboleth Service Provider -- SQL injection vulnerability in ODBC plugin

Internet2 reports: The Shibboleth Service Provider includes a storage API usable for a number of different use cases such as the session cache, replay cache, and relay state management. An ODBC extension plugin is provided with some distributions of the software notably on Windows. A SQL injectio...

Linux Distros Unpatched Vulnerability : CVE-2021-40691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A session hijack risk was identified in the Shibboleth authentication plugin. CVE-2021-40691 Note that Nessus relies on the presence of the package as reported ...

Linux Distros Unpatched Vulnerability : CVE-2021-28963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters. CVE-2021-28963 Note that Ness...

Linux Distros Unpatched Vulnerability : CVE-2023-36661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for exampl...

Linux Distros Unpatched Vulnerability : CVE-2019-19191

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Shibboleth Service Provider SP 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user the shibd account...

VulnCheck KEV: CVE-2023-36661

Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows...

CVE-2023-22947

Insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the installation goes under C:\opt rather than...

CVE-2022-24129

The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery SSRF due to insufficient restriction of the requesturi parameter. This allows attackers to interact with arbitrary third-party HTTP services...

CVE-2021-36394

In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin...

CVE-2021-20187

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that it was possible for site administrators to execute arbitrary PHP scripts via a PHP include used during Shibboleth authentication...