Picketlink

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Picketlink records in CISA KEV

No Picketlink vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Picketlink 3 records LOW

Records

3 records in Picketlink · all components

TI-2015-00244 CVE-2015-0277 · GHSA-vhqm-6xhg-59wv

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member…

LOW 31

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts v…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0196 Published 2015-08-17 Fixed CWE-284

TI-2015-05246 CVE-2015-6254 · GHSA-cc8r-2q55-6c87

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0…

LOW 30

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the messag…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01781 Published 2015-08-17 Fixed CWE-17

TI-2015-02790 CVE-2015-3158 · GHSA-9qhq-j4xm-cw48

The invokeNextValve function in…

LOW 23

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01913 Published 2015-08-26 Partial fix · 2.7.1.Final CWE-264

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0