Vulnerabilities

TI-2015-02790 CVE-2015-3158 · GHSA-9qhq-j4xm-cw48

The invokeNextValve function in…

LOW 23

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01913 Published 2015-08-26 Partial fix · 2.7.1.Final CWE-264

TI-2015-05246 CVE-2015-6254 · GHSA-cc8r-2q55-6c87

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0…

LOW 30

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the messag…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01781 Published 2015-08-17 Fixed CWE-17

TI-2015-00244 CVE-2015-0277 · GHSA-vhqm-6xhg-59wv

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member…

LOW 31

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts v…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0196 Published 2015-08-17 Fixed CWE-284

Vulnerabilities

Filters

The invokeNextValve function in…

The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0…

The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member…