Latest shibboleth service provider Vulnerabilities

● CVE-2023-22947

** DISPUTED ** Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via D...

Shibboleth Service Provider<3.4.1

Microsoft Windows

Shibboleth Service Provider<3.4.1

Microsoft Windows

● CVE-2021-31826

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this ...

debian/shibboleth-sp

debian/shibboleth-sp<=3.0.4+dfsg1-1+deb10u1<=3.0.4+dfsg1-1<=3.0.2+dfsg1-1<=3.2.1+dfsg1-1

Shibboleth Service Provider>=3.0.0<3.2.2

● CVE-2021-28963

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.

Shibboleth Service Provider<3.2.1

Debian Debian Linux=10.0

● CVE-2019-19191

Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the us...

Shibboleth Service Provider>=3.0.0<3.1.0

● CVE-2010-2450

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default ...

Shibboleth Service Provider=2.0

Debian Debian Linux=8.0

Debian Debian Linux=9.0

debian/shibboleth-sp

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.