Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2015-1796

Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

CVSS 2.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Shibboleth
Products
Jboss Amq Jboss Fuse Identity Provider and 1 more
CVE-2014-3603

Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Shibboleth
Products
Identity Provider Opensaml Java