Read the docs

simplesamlphp

Records38All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9

Exploited now

simplesamlphp records in CISA KEV

No simplesamlphp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Simplesamlphp 24 records MEDIUM Saml2 4 records MEDIUM Xml-security 2 records HIGH Infocard Module 1 record LOW Information Cards Module 1 record LOW Simplesamlphp-module-casserver 1 record MEDIUM Simplesamlphp-module-openid 1 record LOW Simplesamlphp-module-openidprovider 1 record LOW

Records

4 records in Saml2 · all components

TI-2016-07944 CVE-2016-9814 · GHSA-r8v4-7vwj-983x

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and…

Priority MEDIUM 44

The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML respons…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.02413 Published 2017-02-16 Fixed in 1.10.3, 1.8.1 +2 CWE-399
TI-2018-05557 CVE-2018-7711 · GHSA-g888-g2pp-82hf

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect…

Priority LOW 38

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forc…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01189 Published 2018-03-05 Fixed in 1.10.6, 2.3.8 +1 CWE-347
TI-2023-26752 CVE-2023-49087 · GHSA-ww7x-3gxh-qm6r

Validation of SignedInfo

Priority LOW 32

xml-security is a library that implements XML signatures and encryption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00193 Published 2023-11-30 Partial fix · 1.6.12, 5.0.0-alpha.13 CWE-345
Open these records in search →