Shibboleth Identity Provider
3 CVEs affecting Shibboleth Identity Provider. Latest disclosed: 2020-10-28. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27978 | High | 7.5 | 2020-10-28 | Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhau… |
CVE-2014-3603 | Medium | 5.9 | 2019-04-04 | The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify th… |
CVE-2015-1796 | | 2015-07-08 | The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trust… |