Apereo kayıtları
Apereo üreticisine ait 46 yayımlanmış kayıt. Bunların 0 tanesi sahada sömürüldü (CISA KEV listesinde), 1 tanesi için hazır saldırı aracı var.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 1 · %2,2
- Pre-auth RCE
- 1
- Düzeltme kaydı olan
- %63
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Pre-auth RCE: saldırganın hesabı olmadan, ağ üzerinden kod çalıştırabildiği açıklar. Yayından KEV’e ortanca: sahada sömürülen kayıtların yayımlanmasıyla CISA listesine girmesi arasındaki tipik süre.
Tekrar eden sınıflar
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor4
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')3
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-611 Improper Restriction of XML External Entity Reference3
- CWE-287 Improper Authentication3
- CWE-285 Improper Authorization2
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
46 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | EPSS · Yayın |
|---|---|---|---|---|
60Bu hafta | CVE-2026-32985Silahlaştırılmış | Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Executionapereo · xerte online toolkits · CWE-306 | Kritik9,3 | %1,519 Mar 2026 |
41Planlayın | CVE-2014-4172İstismar yok | A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client beapereo · .net cas client · CWE-74 | Kritik9,8 | %6,024 Oca 2020 |
40Planlayın | CVE-2020-5206İstismar yok | Authentication Bypass For Endpoints With Anonymous Access in OpenCastapereo · opencast · CWE-285 | Kritik10,0 | %1,230 Oca 2020 |
39İzleyin | CVE-2023-4612İstismar yok | MFA bypass in Apereo CASapereo · central authentication service · CWE-302 | Kritik9,8 | %1,19 Kas 2023 |
37İzleyin | CVE-2024-4399Kavram kanıtı | CAS <= 1.0.0 - Unauthenticated SSRFapereo · central authentication service · CWE-918 | Kritik9,1 | %1,823 May 2024 |
36İzleyin | CVE-2014-2296İstismar yok | XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2apereo · cas server · CWE-611 | Yüksek8,8 | %2,020 Tem 2018 |
36İzleyin | CVE-2018-1000836İstismar yok | bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser thaapereo · bw-calendar-engine · CWE-611 | Kritik9,0 | %1,120 Ara 2018 |
35İzleyin | CVE-2020-5222İstismar yok | Hard-Coded Key Used For Remember-me Token in OpenCastapereo · opencast · CWE-798 | Yüksek8,8 | %0,930 Oca 2020 |
33İzleyin | CVE-2017-1000071İstismar yok | Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against aapereo · phpcas · CWE-287 | Yüksek8,1 | %3,517 Tem 2017 |
33İzleyin | CVE-2022-39369İstismar yok | Service Hostname Discovery Exploitation in phpCASapereo · phpcas · CWE-99 | Yüksek8,0 | %2,41 Kas 2022 |
33İzleyin | CVE-2019-10754İstismar yok | Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generaapereo · central authentication service · CWE-338 | Yüksek8,1 | %1,723 Eyl 2019 |
32İzleyin | CVE-2020-5229İstismar yok | Opencast stores passwords using outdated MD5 hash algorithmapereo · opencast · CWE-327 | Yüksek8,1 | %0,630 Oca 2020 |
31İzleyin | CVE-2015-1169İstismar yok | Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted userapereo · central authentication service · CWE-74 | Yüksek7,5 | %2,810 Şub 2015 |
31İzleyin | CVE-2021-43821Kavram kanıtı | Files Accessible to External Parties in Opencastapereo · opencast · CWE-552 | Yüksek7,7 | %2,014 Ara 2021 |
31İzleyin | CVE-2018-20000İstismar yok | Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to wapereo · bw-webdav · CWE-611 | Yüksek7,5 | %1,69 Ara 2018 |
30İzleyin | CVE-2020-27178İstismar yok | Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenapereo · central authentication service | Yüksek7,5 | %1,216 Eki 2020 |
30İzleyin | CVE-2020-5230İstismar yok | Opencast uses unsafe identifiersapereo · opencast · CWE-99 | Yüksek7,5 | %1,130 Oca 2020 |
30İzleyin | CVE-2020-5228İstismar yok | Opencast allows unauthorized public access via OAI-PMHapereo · opencast · CWE-862 | Yüksek7,5 | %0,930 Oca 2020 |
30İzleyin | CVE-2024-52797İstismar yok | Searching Opencast may cause a denial of serviceapereo · opencast · CWE-770 | Yüksek7,5 | %0,921 Kas 2024 |
30İzleyin | CVE-2018-16153İstismar yok | An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.apereo · opencast · CWE-522 | Yüksek7,5 | %0,812 Ara 2023 |
30İzleyin | CVE-2023-28857İstismar yok | LDAP password leak in Apereo CAS - GHSL-2023-009apereo · central authentication service · CWE-200 | Yüksek7,5 | %0,527 Haz 2023 |
26İzleyin | CVE-2021-42567Kavram kanıtı | Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.apereo · central authentication service · CWE-79 | Orta6,1 | %8,17 Ara 2021 |
26İzleyin | CVE-2010-3692İstismar yok | Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote aapereo · phpcas · CWE-22 | Orta6,4 | %3,67 Eki 2010 |
26İzleyin | CVE-2021-43807İstismar yok | HTTP Method Spoofing in Opencastapereo · opencast · CWE-290 | Orta6,5 | %1,414 Ara 2021 |
26İzleyin | CVE-2021-32623İstismar yok | Opencast vulnerable to billion laughs attack (XML bomb)apereo · opencast · CWE-776 | Orta6,5 | %1,215 Haz 2021 |
- CVE-2026-3298560Bu hafta
Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution
KritikCVSS 9,3SilahlaştırılmışEPSS %1apereo · xerte online toolkits19 Mar 2026
- CVE-2014-417241Planlayın
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client be
KritikCVSS 9,8İstismar yokEPSS %6apereo · .net cas client24 Oca 2020
- CVE-2020-520640Planlayın
Authentication Bypass For Endpoints With Anonymous Access in OpenCast
KritikCVSS 10,0İstismar yokEPSS %1apereo · opencast30 Oca 2020
- CVE-2023-461239İzleyin
MFA bypass in Apereo CAS
KritikCVSS 9,8İstismar yokEPSS %1apereo · central authentication service9 Kas 2023
- CVE-2024-439937İzleyin
CAS <= 1.0.0 - Unauthenticated SSRF
KritikCVSS 9,1Kavram kanıtıEPSS %1apereo · central authentication service23 May 2024
- CVE-2014-229636İzleyin
XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2
YüksekCVSS 8,8İstismar yokEPSS %2apereo · cas server20 Tem 2018
- CVE-2018-100083636İzleyin
bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser tha
KritikCVSS 9,0İstismar yokEPSS %1apereo · bw-calendar-engine20 Ara 2018
- CVE-2020-522235İzleyin
Hard-Coded Key Used For Remember-me Token in OpenCast
YüksekCVSS 8,8İstismar yokEPSS %0apereo · opencast30 Oca 2020
- CVE-2017-100007133İzleyin
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against a
YüksekCVSS 8,1İstismar yokEPSS %3apereo · phpcas17 Tem 2017
- CVE-2022-3936933İzleyin
Service Hostname Discovery Exploitation in phpCAS
YüksekCVSS 8,0İstismar yokEPSS %2apereo · phpcas1 Kas 2022
- CVE-2019-1075433İzleyin
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID genera
YüksekCVSS 8,1İstismar yokEPSS %1apereo · central authentication service23 Eyl 2019
- CVE-2020-522932İzleyin
Opencast stores passwords using outdated MD5 hash algorithm
YüksekCVSS 8,1İstismar yokEPSS %0apereo · opencast30 Oca 2020
- CVE-2015-116931İzleyin
Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted user
YüksekCVSS 7,5İstismar yokEPSS %2apereo · central authentication service10 Şub 2015
- CVE-2021-4382131İzleyin
Files Accessible to External Parties in Opencast
YüksekCVSS 7,7Kavram kanıtıEPSS %2apereo · opencast14 Ara 2021
- CVE-2018-2000031İzleyin
Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to w
YüksekCVSS 7,5İstismar yokEPSS %1apereo · bw-webdav9 Ara 2018
- CVE-2020-2717830İzleyin
Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authen
YüksekCVSS 7,5İstismar yokEPSS %1apereo · central authentication service16 Eki 2020
- CVE-2020-523030İzleyin
Opencast uses unsafe identifiers
YüksekCVSS 7,5İstismar yokEPSS %1apereo · opencast30 Oca 2020
- CVE-2020-522830İzleyin
Opencast allows unauthorized public access via OAI-PMH
YüksekCVSS 7,5İstismar yokEPSS %0apereo · opencast30 Oca 2020
- CVE-2024-5279730İzleyin
Searching Opencast may cause a denial of service
YüksekCVSS 7,5İstismar yokEPSS %0apereo · opencast21 Kas 2024
- CVE-2018-1615330İzleyin
An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.
YüksekCVSS 7,5İstismar yokEPSS %0apereo · opencast12 Ara 2023
- CVE-2023-2885730İzleyin
LDAP password leak in Apereo CAS - GHSL-2023-009
YüksekCVSS 7,5İstismar yokEPSS %0apereo · central authentication service27 Haz 2023
- CVE-2021-4256726İzleyin
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
OrtaCVSS 6,1Kavram kanıtıEPSS %8apereo · central authentication service7 Ara 2021
- CVE-2010-369226İzleyin
Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote a
OrtaCVSS 6,4İstismar yokEPSS %3apereo · phpcas7 Eki 2010
- CVE-2021-4380726İzleyin
HTTP Method Spoofing in Opencast
OrtaCVSS 6,5İstismar yokEPSS %1apereo · opencast14 Ara 2021
- CVE-2021-3262326İzleyin
Opencast vulnerable to billion laughs attack (XML bomb)
OrtaCVSS 6,5İstismar yokEPSS %1apereo · opencast15 Haz 2021