Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...

Cross-site Scripting (XSS)

cas-client is vulnerable to cross-site scripting XSS. The vulnerability exists as the value of value from URL encoded parameters in AbstractUrlBasedTicketValidator.java is not sanitized...