Vulnerabilities > Shibboleth

DATE CVE VULNERABILITY TITLE RISK
2018-01-13 CVE-2018-0486 Improper Verification of Cryptographic Signature vulnerability in multiple products
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
network
low complexity
shibboleth debian CWE-347
6.5
2017-11-16 CVE-2017-16853 Improper Verification of Cryptographic Signature vulnerability in multiple products
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.
network
high complexity
shibboleth debian CWE-347
8.1
2017-11-16 CVE-2017-16852 Improper Verification of Cryptographic Signature vulnerability in multiple products
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.
network
high complexity
shibboleth debian CWE-347
8.1