CVE-2010-3691

CVE-2010-3691 affects phpCAS (in Moodle) prior to version 1.1.3. When proxy mode is enabled, PGTStorage/pgt-file.php is vulnerable to a local symlink attack that allows a local user to overwrite arbitrary files. The exposed component is phpCAS in Moodle installations, with potential for file over...

CVE-2010-3690

CVE-2010-3690 refers to multiple cross-site scripting (XSS) flaws in the phpCAS library used by Moodle, exploitable when proxy mode is enabled. The vulnerabilities allow remote attackers to inject arbitrary script/HTML via the Proxy Granting Ticket IOU parameter to the callback (client.php) or th...

CVE-2010-3692

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU PGTiou parameter...

CVE-2010-3691

PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file...

CVE-2010-3692: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU PGTiou parameter...

CVE-2010-3691: Improper Link Resolution Before File Access

PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file...

CVE-2010-3690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via 1 a crafted Proxy Granting Ticket IOU PGTiou parameter to the callback function in client.php, 2 vectors involving functions that...

Fedora 13 : php-pear-CAS-1.1.2-1.fc13 (2010-12258)

Security fixes Fix a session hijacking hole CVE-2010-2795 PHPCAS-61 callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 PHPCAS-67 Bug fixes Fix warnings for SAML responses without attributes PHPCAS-59 Fix duplicate SAML debug output PHPCAS-64 Providing a new ST/PT/SA during...

phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities

This host is installed with phpCAS and is prone to session hijacking and cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbphpcassessionhijacknxssvuln.nasl 7823 2017-11-20 08:54:04Z cfischer $ phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities Authors: Madhuri...

phpCAS Session Hijacking and Cross-Site Scripting Vulnerabilities

phpCAS is prone to session hijacking and cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-2796

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...

CVE-2010-2795

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

Cross site scripting

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...

Spoofing

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

CVE-2010-2796

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...

CVE-2010-2796

CVE-2010-2796 is an XSS vulnerability in phpCAS prior to 1.1.2 when proxy mode is enabled, allowing an attacker to inject script via a callback URL. The flaw affects phpCAS usage embedded in applications such as Moodle that include phpCAS. Remediation references imply upgrading to phpCAS 1.1.2 or...

CVE-2010-2795

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

CVE-2010-2795

Summary : CVE-2010-2795 concerns the phpCAS library (pre-1.1.2) used by PHP-based apps such as Moodle. The vulnerability allows a remote authenticated user to hijack a session by supplying a crafted ticket value in the query string. The issue has been publicly discussed in multiple advisories (e....

CVE-2010-2795: Improper Input Validation

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value...

CVE-2010-2796: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL...