CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-5583
https://notcve.org/view.php?id=CVE-2012-5583
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. phpCAS anterior a 1.3.2 no verifica que el nombre del servidor coincide con un nombre de dominio en el campo del asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL a través de un certificado válido arbitrario. • http://secunia.com/advisories/51818 https://exchange.xforce.ibmcloud.com/vulnerabilities/81208 https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog • CWE-310: Cryptographic Issues •
CVSS: 3.3EPSS: 0%CPEs: 30EXPL: 0CVE-2010-3691
https://notcve.org/view.php?id=CVE-2010-3691
PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file. PGTStorage/pgt-file.php en phpCAS anterior a v1.1.3, cuando el modo proxy está habilitado, permite a usuarios locales sobreescribir ficheros arbitrarios mediante un ataque de enlace simbólico sobre un fichero sin especificar. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html http://secunia.com/advisories/41878 http://secunia.com/advisories/42149 http://secunia.com/advisories/42184 http:/ • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.4EPSS: 1%CPEs: 30EXPL: 0CVE-2010-3692
https://notcve.org/view.php?id=CVE-2010-3692
Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter. Vulnerabilidad de salto de directorio en la función callback en client.php en phpCAS anterior a v1.1.3, cuando el modo proxy está habilitado, permite a atacantes crear o sobreescribir ficheros arbitrarios mediante secuencias de salto de directorio en el parámetro Proxy Granting Ticket IOU (PGTiou). • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html http://secunia.com/advisories/41878 http://secunia.com/advisories/42149 http://secunia.com/advisories/42184 http:/ • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 30EXPL: 0CVE-2010-3690
https://notcve.org/view.php?id=CVE-2010-3690
Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en phpCAS anterior a v1.1.3, cuando el modo proxy está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML (1) a través del parámetro modificado Proxy Granting Ticket IOU (PGTiou) para la función callback en client.php y vectores que implican funciones que realizan llamadas getCallbackURL, o (3) vectores que implican funciones que realizan llamadas getURL • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html http://secunia.com/advisories/41878 http://secunia.com/advisories/42149 http://secunia.com/advisories/42184 http:/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •