Apereo

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the s…

Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality that allows remote attackers to execute arbitrary code by uploading a cr…

Apereo CAS is an open source multilingual single sign-on solution for the web.

A vulnerability was found in Apereo CAS 6.6 and classified as problematic.

A vulnerability was found in Apereo CAS 6.6.

A vulnerability has been found in Apereo CAS 6.6 and classified as problematic.

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow rem…

Opencast is an Open Source Lecture Capture & Video Management for Education.

Opencast is a free, open-source platform to support the management of educational audio and video content.

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked…

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7.

XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated u…

phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server.

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port s…

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key.

An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not…

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

Opencast is a free and open source solution for automated video capture and distribution.

Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP au…

Opencast is an Open Source Lecture Capture & Video Management for Education.

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used.

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm.