CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-27978
https://notcve.org/view.php?id=CVE-2020-27978
28 Oct 2020 — Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session. Shibboleth Identify Provider versiones 3.x anteriores a 3.4.6, presenta un fallo de denegación de servicio. Un atacante remoto no autenticado puede causar un flujo de inicio de sesión para desencadenar un agotamiento de la pila de Java debido a la creación de objetos en l... • https://shibboleth.net/community/advisories/secadv_20191002.txt • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2014-3603
https://notcve.org/view.php?id=CVE-2014-3603
04 Apr 2019 — The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Las implementaciones de (1) HttpResource y (2) FileBackedHttpResource en el Proveedor de Identidad (IdP) de Shibboleth, en ver... • http://secunia.com/advisories/60816 • CWE-297: Improper Validation of Certificate with Host Mismatch •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2015-1796 – Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation
https://notcve.org/view.php?id=CVE-2015-1796
23 Jun 2015 — The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor. Los motores de confianza PKIX en Shibboleth Identity Provider anterior a 2.4.4 y OpenSAML Java (OpenSAML-J) anterior a 2.6.5 confían en los certificados X.509 de candidatos cuando nombres no co... • http://rhn.redhat.com/errata/RHSA-2015-1176.html • CWE-254: 7PK - Security Features •
CVSS: 5.8EPSS: 0%CPEs: 15EXPL: 0CVE-2011-1411
https://notcve.org/view.php?id=CVE-2011-1411
02 Sep 2011 — Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack." La librería Shibboleth OpenSAML v2.4.x antes de v2.4.3 y v2.5.x antes de v2.5.1, e IdP antes de v2.3.2, permite a atacantes remotos falsificar mensajes y eludir la autenticación a través de un ataque "XML Signature wrapping" • http://secunia.com/advisories/50994 • CWE-287: Improper Authentication •