https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T00:16:43.090361+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2014-avi-385 certfr-2014-avi-385 — De multiples vulnérabilités ont été corrigées dans <span class="textit">Moodle</span>. Elles permettent à un attaquant… 2026-10-03T00:16:43.095210+00:00 certfr-2014-avi-385 https://cve.radiocsirt.org/vuln/euvd-2026-99809 EUVD-2026-99809 2026-10-03T00:16:43.095254+00:00 EUVD-2026-99809 https://cve.radiocsirt.org/vuln/fkie_cve-2014-4172 fkie_cve-2014-4172 2026-10-03T00:16:43.095269+00:00

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

 https://cve.radiocsirt.org/vuln/ghsa-9fc5-q25c-r2wr GHSA-9fc5-q25c-r2wr — Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability 2026-10-03T00:16:43.095297+00:00

Affected: NuGet: DotNetCasClient, Maven: org.jasig.cas:cas-client, Packagist: jasig/phpcas

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

 https://cve.radiocsirt.org/vuln/gsd-2014-4172 gsd-2014-4172 2026-10-03T00:16:43.095324+00:00 gsd-2014-4172 https://cve.radiocsirt.org/vuln/rhsa-2015:1009 RHSA-2015:1009 — Red Hat Security Advisory: Red Hat JBoss Portal 6.2.0 update 2026-10-03T00:16:43.095336+00:00

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix bouncycastle: TLS CBC padding timing attack WS: EJB3 role restrictions are not applied to jaxws handlers tomcat: multiple content-length header poisoning flaws JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions XStream: remote code execution due to insecure XML deserialization PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application jboss-as-server: Unchecked access to MSC Service Registry under JSM CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream EAP6: Plain text password logging during security audit JBossSX/PicketBox: World readable audit.log file Tomcat/JBossWeb: Limited DoS in chunked transfer encoding input filter RichFaces: remote denial of service via memory exhaustion 6: JSM policy not respected by deployed applications Tomcat/JBossWeb: XXE vulnerability via user supplied XSLTs Tomcat/JBossWeb: Request smuggling via malicious content length header Xalan-Java: insufficient constraints in secure processing feature CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill Tomcat/JBossWeb: XML parser hijack by malici…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2014-4172 Withdrawn: UBUNTU-CVE-2014-4172 2026-10-03T00:16:43.095386+00:00

Withdrawn by the publisher.

Affected: Ubuntu:16.04:LTS: php-cas

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.