Uninett
9 CVEs across 2 Uninett products. Browse Uninett vulnerabilities, severities, and proof-of-concept exploits.
Uninett products with known CVEs
Uninett CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2021-3639 | Medium | 6.1 | 2022-08-22 | A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by… |
CVE-2021-32642 | High | 7.0 | 2021-05-28 | radsecproxy is a generic RADIUS proxy that supports both UDP and TLS (RadSec) RADIUS transports. Missing input validation in radsecproxy's `naptr-eduroam.sh` a… |
CVE-2019-3877 | Medium | 5.8 | 2019-03-27 | A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming th… |
CVE-2019-3878 | High | 8.1 | 2019-03-26 | A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through a… |
CVE-2017-6807 | Medium | 6.1 | 2017-03-13 | mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy thei… |
CVE-2016-2146 | High | 7.5 | 2016-04-15 | The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of serv… |
CVE-2016-2145 | High | 7.5 | 2016-04-15 | The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attack… |
CVE-2014-8566 | | | 2014-11-15 | The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecifi… |
CVE-2014-8567 | | | 2014-11-14 | The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that trigg… |
CVE-2012-4566 | | | 2012-11-20 | The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to t… |
CVE-2012-4523 | | | 2012-11-20 | radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used… |