Uninett Mod Auth Mellon
8 CVEs affecting Uninett Mod Auth Mellon. Latest disclosed: 2022-08-22. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3878 | High | 8.1 | 2019-03-26 | A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through a… |
CVE-2016-2146 | High | 7.5 | 2016-04-15 | The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of serv… |
CVE-2016-2145 | High | 7.5 | 2016-04-15 | The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attack… |
CVE-2021-3639 | Medium | 6.1 | 2022-08-22 | A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by… |
CVE-2017-6807 | Medium | 6.1 | 2017-03-13 | mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy thei… |
CVE-2019-3877 | Medium | 5.8 | 2019-03-27 | A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming th… |
CVE-2014-8566 | | 2014-11-15 | The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecifi… | |
CVE-2014-8567 | | 2014-11-14 | The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that trigg… |