CVE-2021-36394-Pre-Auth-RCE-in-Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Vulnerability Introduction Moodle is the most popular learning management system in the world. Start creating your eLearning website in minutes! An unauthorized remote code execution vulnerability exists in the Shibboleth authentication module of Moodle. This...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Shibboleth vulnerability (USN-8768-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8768-1 advisory. Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibl...

USN-8768-1: Shibboleth vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...

USN-8768-1 shibboleth-sp vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...

Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

jhub-shibboleth-auth (1.0.0) potentially affected by CVE-2026-54338 via jupyterhub (0.8.1)

jupyterhub PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.0.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

jhub-shibboleth-auth (1.4.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.4)

jupyterhub PYPI version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.4.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

jhub-shibboleth-auth (1.2.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.1)

jupyterhub PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.2.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

jhub-shibboleth-auth (1.3.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.2)

jupyterhub PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.3.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

jhub-shibboleth-auth (1.5.0), jupyterhub-ltiauthenticator (>=0.1.0, <=0.2.0) +1 more potentially affected by CVE-2026-54338 via jupyterhub (0.9.6)

jupyterhub PYPI version 0.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.5.0 - jupyterhub-ltiauthenticator =0.1.0, =0.0.2, =0.0.9 Source cves: CVE-2026-54338 Source advisory:...

jhub-shibboleth-auth (1.1.0) potentially affected by CVE-2026-54338 via jupyterhub (0.9.0)

jupyterhub PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterhub and may be impacted: - jhub-shibboleth-auth 1.1.0 Source cves: CVE-2026-54338 Source advisory: OSV:PYSEC-2026-3853...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

CVE-2026-80428

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

EUVD-2026-66602

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shiblogout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428

ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...