shibboleth

Top products

The 15 most recently published vulnerabilities affecting shibboleth.

• CVE-2025-9943Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider9.1Sep 10, 2025
• CVE-2025-31335The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).4.0Mar 28, 2025
• CVE-2023-36661Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1...7.5Jun 25, 2023
• CVE-2023-22947Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting ...7.3Jan 11, 2023
• CVE-2022-24129The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to int...8.2Feb 4, 2022
• CVE-2021-31826Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using th...7.5Apr 27, 2021
• CVE-2021-28963Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.5.3Mar 22, 2021
• CVE-2020-27978Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects i...7.5Oct 28, 2020
• CVE-2019-19191Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after installation. This allows the...7.8Nov 21, 2019
• CVE-2010-2450The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (defau...7.5Nov 7, 2019
• CVE-2014-3603The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domai...5.9Apr 4, 2019
• CVE-2018-0489Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers ...6.5Feb 27, 2018
• CVE-2018-0486Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote at...6.5Jan 13, 2018
• CVE-2017-16852shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and...8.1Nov 16, 2017
• CVE-2017-16853The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins a...8.1Nov 16, 2017