62 matches found
CVE-2026-15243: Improper Validation of Certificate with Host Mismatch
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...
org.grails:grails-core (>=1.2.0.rc2, <=1.3.0), org.grails:grails-crud (>=1.2.0.rc2, <=1.3.0) +8 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.0.0.release)
org.springframework:spring-jms MAVEN version 3.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.grails:grails-core =1.2.0.rc2, =1.2.0.rc2, =1.2.0.rc2, =1.2.0, =1.2.0.rc2, =1.2.0.rc2,...
org.apache.rya:rya.export.accumulo (>=4.0.0-incubating, <=4.0.1), org.apache.rya:rya.indexing.example (>=4.0.0-incubating, <=4.0.1) +30 more potentially affected by CVE-2026-41842 via org.springframework:spring-webmvc (3.2.15.release)
org.springframework:spring-webmvc MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.rya:rya.export.accumulo =4.0.0-incubating, =4.0.0-incubating,...
org.jasig.cas:cas-management-webapp (>=4.2.0-rc1, <=4.2.1), org.jasig.cas:cas-management-webapp-support (>=4.2.0-rc1, <=4.2.1) +65 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.2)
org.pac4j:pac4j-core MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.jasig.cas:cas-management-webapp =4.2.0-rc1, =4.2.0-rc1, =4.2.0-rc1, =4.2.0-rc1, =4.2.0-rc3, =4.2.0-rc1, =4.2.0-rc1,...
EUVD-2014-2334
Malware in sbrugna...
EUVD-2017-1388
Malware in sbrugna...
EUVD-2012-1139
Malware in sbrugna...
EUVD-2022-3362
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2017-1000071
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...
Apereo Central Authentication Service (CAS) Detection Consolidation
Consolidation of Apereo formerly Jasig Central Authentication Service CAS detections. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
GHSA-9FC5-Q25C-R2WR Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
org.apache.rya:rya.export.accumulo (>=4.0.0-incubating, <=4.0.1), org.apache.rya:rya.indexing.example (>=4.0.0-incubating, <=4.0.1) +30 more potentially affected by CVE-2022-22965 via org.springframework:spring-webmvc (3.2.15.release)
org.springframework:spring-webmvc MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.rya:rya.export.accumulo =4.0.0-incubating, =4.0.0-incubating,...
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
CVE-2014-4172
The CVE-2014-4172 issue affects Jasig Java CAS Client (<3.3.2), .NET CAS Client (<1.0.2), and phpCAS (
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...
CVE-2014-4172: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the 1 service...