Shibboleth vulnerabilities

Products

• Service Provider 7
• Identity Provider 3
• Opensaml 3
• Opensaml Java 2
• Xmltooling-c 2

Newest

• shibboleth service provider Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider CVE-2025-9943 Fix available 9.1 CriticalSeptember 7, 2025
• shibboleth opensaml c++ library The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter... CVE-2025-31335 Fix available 4.0 MediumMarch 16, 2025
• shibboleth xmltooling, debian linux +1 more Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows... CVE-2023-36661 Public exploitFix available 7.5 HighJune 18, 2023
• shibboleth service provider ** DISPUTED ** Insecure folder permissions in the Windows installation path of Shibboleth Service... CVE-2023-22947 Disputed 7.3 HighJanuary 11, 2023
• shibboleth oidc op The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request... CVE-2022-24129 8.2 HighFebruary 4, 2022
• shibboleth service provider Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw... CVE-2021-31826 Fix available 7.5 HighApril 27, 2021
• shibboleth service provider, debian linux +1 more Shibboleth Service Provider before 3.2.1 allows content injection because template generation... CVE-2021-28963 Fix available 5.3 MediumMarch 18, 2021
• shibboleth identity provider Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote... CVE-2020-27978 7.5 HighOctober 28, 2020
• shibboleth service provider Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files... CVE-2019-19191 Fix available 7.8 HighNovember 21, 2019
• debian linux, shibboleth service provider +1 more The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses... CVE-2010-2450 7.5 HighNovember 7, 2019
• shibboleth identity provider, opensaml java, shibboleth; opensaml java identity provider (idp) +2 more Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java CVE-2014-3603 Fix available 5.9 MediumApril 4, 2019
• shibboleth xmltooling-c, arubanetworks clearpass, debian linux +2 more Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on... CVE-2018-0489 Fix available 6.5 MediumFebruary 27, 2018
• shibboleth xmltooling-c, debian linux +1 more Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on... CVE-2018-0486 Fix available 6.5 MediumJanuary 12, 2018
• shibboleth opensaml, debian linux +1 more The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in... CVE-2017-16853 Fix available 8.1 HighNovember 16, 2017
• shibboleth service provider, debian linux +1 more shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth... CVE-2017-16852 Fix available 8.1 HighNovember 16, 2017
• shibboleth identity provider, opensaml java +1 more Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML CVE-2015-1796 Fix available 4.3 MediumJuly 8, 2015
• shibboleth service provider, debian linux +1 more Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial... CVE-2015-2684 Fix available 4.0 MediumMarch 28, 2015
• internet2 opensaml Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML CVE-2013-6440 Fix available 5.0 MediumFebruary 14, 2014
• shibboleth opensaml, shibboleth-identity-provider +1 more Improper Authentication in OpenSAML CVE-2011-1411 Fix available 5.8 MediumJuly 25, 2011
• apache xml security for c\+\+, shibboleth shibboleth-sp +1 more Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in... CVE-2011-2516 Fix available 5.0 MediumJuly 10, 2011