Skip to content
Noroxi

Shibboleth records

18 published records for vendor shibboleth.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 5.6%
Pre-auth RCE
0
With a fix record
77.8%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

18 records
  • CVE-2023-36661
    60This week

    Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element.

    HighCVSS 7.5WeaponizedEPSS 2%

    shibboleth · xmltoolingJun 25, 2023

  • CVE-2022-24129
    34Monitor

    The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction o

    HighCVSS 8.2Proof of conceptEPSS 6%

    shibboleth · oidc opFeb 4, 2022

  • CVE-2017-16853
    32Monitor

    The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to pr

    HighCVSS 8.1No exploitEPSS 1%

    shibboleth · opensamlNov 16, 2017

  • CVE-2017-16852
    32Monitor

    shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to prop

    HighCVSS 8.1No exploitEPSS 1%

    shibboleth · service providerNov 16, 2017

  • CVE-2021-31826
    31Monitor

    Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature.

    HighCVSS 7.5No exploitEPSS 2%

    shibboleth · service providerApr 27, 2021

  • CVE-2020-27978
    31Monitor

    Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw.

    HighCVSS 7.5No exploitEPSS 1%

    shibboleth · identity providerOct 28, 2020

  • CVE-2019-19191
    31Monitor

    Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service use

    HighCVSS 7.8No exploitEPSS 0%

    shibboleth · service providerNov 21, 2019

  • CVE-2010-2450
    30Monitor

    The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which i

    HighCVSS 7.5No exploitEPSS 1%

    shibboleth · service providerNov 7, 2019

  • CVE-2023-22947
    29Monitor

    Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local at

    HighCVSS 7.3No exploitEPSS 0%

    shibboleth · service providerJan 10, 2023

  • CVE-2018-0489
    27Monitor

    Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digita

    MediumCVSS 6.5No exploitEPSS 2%

    shibboleth · xmltooling-cFeb 27, 2018

  • CVE-2018-0486
    26Monitor

    Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital

    MediumCVSS 6.5No exploitEPSS 1%

    shibboleth · xmltooling-cJan 13, 2018

  • CVE-2011-1411
    24Monitor

    Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and b

    MediumCVSS 5.8No exploitEPSS 2%

    shibboleth · opensamlSep 2, 2011

  • CVE-2014-3603
    23Monitor

    The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6

    MediumCVSS 5.9No exploitEPSS 0%

    shibboleth · identity providerApr 4, 2019

  • CVE-2011-2516
    22Monitor

    Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other pr

    MediumCVSS 5.0No exploitEPSS 7%

    apache · xml security for c\+\+Jul 11, 2011

  • CVE-2013-6440
    21Monitor

    The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set t

    MediumCVSS 5.0No exploitEPSS 2%

    shibboleth · opensamlFeb 14, 2014

  • CVE-2021-28963
    21Monitor

    Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.

    MediumCVSS 5.3No exploitEPSS 1%

    shibboleth · service providerMar 22, 2021

  • CVE-2015-2684
    17Monitor

    Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML mess

    MediumCVSS 4.0No exploitEPSS 1%

    shibboleth · service providerMar 31, 2015

  • CVE-2015-1796
    17Monitor

    The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 creden

    MediumCVSS 4.3No exploitEPSS 1%

    shibboleth · identity providerJul 8, 2015