PT-2019-6732

Name of the Vulnerable Software and Affected Versions phpCAS version 1.2.2 Description A Security Bypass issue exists due to the way proxying of services are managed. Recommendations For phpCAS version 1.2.2, at the moment, there is no information about a newer version that contains a fix for thi...

CVE-2012-1104: Improper Privilege Management

A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed...

Authentication Bypass

phpCAS is vulnerable to authentication bypasses. When authenticating against older CAS servers, a malicious user can bypass authentication by injecting xml tags into the ticket...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

DEBIAN-CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

UBUNTU-CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

Authentication flaw

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071: Improper Authentication

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server...

CVE-2017-1000071

CVE-2017-1000071 affects Jasig phpCAS 1.3.4. The vulnerability is an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server. Connected sources confirm the affected component and scenario, but do not provide exploit details or a confirmed patc...

PT-2017-10778

Name of the Vulnerable Software and Affected Versions Jasig phpCAS version 1.3.4 Description The issue concerns an authentication bypass in the validateCAS20 function. This occurs when Jasig phpCAS is configured to authenticate against an old CAS server. Recommendations For Jasig phpCAS version...

Moodle < 2.5 / 2.5.x < 2.5.8 / 2.6.x < 2.6.5 / 2.7.x < 2.7.2 Multiple Vulnerabilities

Binary data 8719.prm...

[SECURITY] [DSA 3017-1] php-cas security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3017-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst September 2, 2014 http://www.debian.org/security/faq -...

PT-2020-7671

Name of the Vulnerable Software and Affected Versions Jasig Java CAS Client versions prior to 3.3.2 .NET CAS Client versions prior to 1.0.2 phpCAS versions prior to 1.3.3 Description A URL parameter injection issue was found in the CAS protocol, specifically in the back-channel ticket validation...

DSA-3017-1 php-cas - security update

Bulletin has no description...

DEBIAN-CVE-2012-5583

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...