Apereo vulnerabilities

Products

• Opencast 20
• Central Authentication Service 13
• Cas 11
• Phpcas 9
• Cas Server 3

Newest

• apereo jasig cas client, java apereo cas client +1 more Improper Validation of Certificate in CAS Client CVE-2026-15243 7.4 HighJuly 24, 2026
• apereo cas Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure CVE-2026-59099 9.3 CriticalJuly 2, 2026
• apereo xerte online toolkits, xerte online toolkits +1 more Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution CVE-2026-32985 Public exploit 9.3 CriticalMarch 20, 2026
• apereo opencast Opencast's editor accidentally publishes videos/overwrites publications #1626 CVE-2025-61906 2.3 LowOctober 8, 2025
• apereo opencast Opencast Paella Player 7 vulnerable to Cross-Site-Scripting CVE-2025-61788 5.1 MediumOctober 8, 2025
• apereo opencast Opencast has a partial path traversal vulnerability in UI config CVE-2025-55202 Fix available 2.7 LowAugust 29, 2025
• apereo opencast Opencast still publishes global system account credentials CVE-2025-54380 Fix available 6.5 MediumJuly 25, 2025
• apereo cas, central authentication service +1 more Apereo CAS CasConfigurationMetadataServerController.java redos CVE-2025-3986 5.3 MediumApril 27, 2025
• apereo cas, central authentication service +1 more Apereo CAS ResponseEntity redos CVE-2025-3985 5.1 MediumApril 27, 2025
• apereo cas, central authentication service +1 more Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection CVE-2025-3984 2.3 LowApril 27, 2025
• apereo opencast Searching Opencast may cause a denial of service CVE-2024-52797 Fix available 6.5 MediumNovember 20, 2024
• apereo cas, cas server, central authentication service +2 more Apereo CAS 2FA login improper authentication CVE-2024-11209 5.3 MediumNovember 14, 2024
• apereo cas, cas server, central authentication service +2 more Apereo CAS login session expiration CVE-2024-11208 6.3 MediumNovember 14, 2024
• apereo cas, central authentication service +1 more Apereo CAS login redirect CVE-2024-11207 5.3 MediumNovember 14, 2024
• apereo cas, central authentication service +1 more CAS <= 1.0.0 - Unauthenticated SSRF CVE-2024-4399 9.1 CriticalMay 23, 2024
• apereo cas CAS <= 1.0.0 - Unauthenticated Arbitrary File Access CVE-2024-4388 7.5 HighMay 23, 2024
• apereo cas, central authentication service +1 more MFA bypass in Apereo CAS CVE-2023-4612 9.8 CriticalNovember 9, 2023
• apereo cas, central authentication service +1 more LDAP password leak in Apereo CAS - GHSL-2023-009 CVE-2023-28857 Fix available 4.0 MediumJune 27, 2023
• apereo opencast Opencast Authenticated OpenRedirect Vulnerability CVE-2022-41965 Fix available 5.7 MediumNovember 28, 2022
• apereo phpcas, fedoraproject fedora +1 more Service Hostname Discovery Exploitation in phpCAS CVE-2022-39369 Fix available 8.0 HighNovember 1, 2022
• apereo opencast Limited Authentication Bypass for Media Files in Opencast CVE-2022-29237 Fix available 5.4 MediumMay 24, 2022
• apereo opencast Opencast publishes global system account credentials CVE-2018-16153 Fix available 7.5 HighDecember 14, 2021
• apereo opencast Files Accessible to External Parties in Opencast CVE-2021-43821 Public exploitFix available 9.9 CriticalDecember 14, 2021
• apereo opencast HTTP Method Spoofing in Opencast CVE-2021-43807 Fix available 7.5 HighDecember 14, 2021
• apereo central authentication service Cross-site Scripting in Apereo CAS CVE-2021-42567 Fix available 6.1 MediumDecember 7, 2021
• apereo opencast Opencast vulnerable to billion laughs attack (XML bomb) CVE-2021-32623 Fix available 8.1 HighJune 15, 2021
• apereo opencast Removing access may not effect published series CVE-2021-21318 5.4 MediumFebruary 18, 2021
• apereo opencast Disabled Hostname Verification in OpenCast CVE-2020-26234 Fix available 4.8 MediumDecember 8, 2020
• apereo central authentication service Improper Authentication in Apereo CAS CVE-2020-27178 Fix available 7.5 HighOctober 16, 2020
• apereo opencast Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVE-2020-5206 Fix available 8.7 HighJanuary 30, 2020
• apereo opencast Opencast users with ROLE_COURSE_ADMIN can create new users CVE-2020-5231 Fix available 4.8 MediumJanuary 30, 2020
• apereo opencast Opencast uses unsafe identifiers CVE-2020-5230 Fix available 7.7 HighJanuary 30, 2020
• apereo opencast Hard-Coded Key Used For Remember-me Token in OpenCast CVE-2020-5222 Fix available 6.8 MediumJanuary 30, 2020
• apereo opencast Opencast stores passwords using outdated MD5 hash algorithm CVE-2020-5229 Fix available 7.7 HighJanuary 30, 2020
• apereo opencast Opencast allows unauthorized public access via OAI-PMH CVE-2020-5228 Fix available 7.6 HighJanuary 30, 2020
• jasig project php-pear-cas, apereo phpcas, debian linux +1 more +3 more An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in... CVE-2012-1105 5.5 MediumDecember 5, 2019
• apereo phpcas, debian linux +1 more A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to... CVE-2012-1104 5.3 MediumDecember 5, 2019
• apereo central authentication service Use of Insufficiently Random Values in Apereo CAS CVE-2019-10754 Fix available 8.1 HighSeptember 23, 2019
• apereo bw-calendar-engine XML External Entity (XXE) vulnerability in bw-calendar-engine CVE-2018-1000836 9.0 CriticalDecember 20, 2018
• apereo bw-webdav Improper Restriction of XML External Entity Reference in bedework:bw-webdav CVE-2018-20000 Fix available 7.5 HighDecember 10, 2018
• apereo cas server XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS... CVE-2014-2296 8.8 HighJuly 20, 2018
• apereo opencast Opencast has Incorrect Permission Assignment CVE-2017-1000221 Fix available 6.5 MediumNovember 17, 2017
• apereo phpcas Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20... CVE-2017-1000071 Fix available 8.1 HighJuly 13, 2017
• apereo central authentication service Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to... CVE-2015-1169 7.5 HighFebruary 10, 2015
• apereo .net cas client, java cas client, phpcas +2 more +4 more Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability CVE-2014-4172 Fix available 9.8 CriticalSeptember 2, 2014
• apereo phpcas phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject... CVE-2012-5583 Fix available 5.8 MediumJune 6, 2014
• apereo phpcas Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3,... CVE-2010-3692 6.4 MediumOctober 7, 2010
• apereo phpcas PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to... CVE-2010-3691 3.3 LowOctober 7, 2010
• apereo phpcas Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is... CVE-2010-3690 4.3 MediumOctober 7, 2010