Vulnerabilities

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality.

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality.

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability.

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module.

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module.

xml-security is a library that implements XML signatures and encryption.

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality.

SimpleSAMLphp xml-common is a common classes for handling XML-structures.

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality.

xml-security is a library that implements XML signatures and encryption.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x.

A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid.

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability.

Cross-site scripting in SimpleSAMLphp before version 1.18.4.

Log injection in SimpleSAMLphp before version 1.18.4.

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate o…

simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forc…

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Iden…

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16.

The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.

The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters.

SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.