Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2018-0489

openSAML: Mishandling of comments in SAML content can lead to bypass of signature verification

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.

CVSS 3.0 · 6.5 Medium EPSS 2.1% KEV · Not listed
Vendors
Arubanetworks Debian Shibboleth
Products
Clearpass Debian Linux Xmltooling-c
CVE-2018-0486

xmltooling: impersonation attack and sensitive information disclosure in the Service Provider via crafted DTD

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Shibboleth
Products
Debian Linux Xmltooling-c