https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:28:37 +0000 https://cve.radiocsirt.org/vuln/cnvd-2015-02765 cnvd-2015-02765 https://cve.radiocsirt.org/vuln/cnvd-2015-02765 https://cve.radiocsirt.org/vuln/euvd-2026-89259 EUVD-2026-89259 https://cve.radiocsirt.org/vuln/euvd-2026-89259 https://cve.radiocsirt.org/vuln/fkie_cve-2015-0277 <p>The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users&#39; accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.</p> <p>The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users&#39; accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2015-0277 https://cve.radiocsirt.org/vuln/ghsa-vhqm-6xhg-59wv <p>The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users&#39; accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.</p> <p>The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users&#39; accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion.</p> https://cve.radiocsirt.org/vuln/ghsa-vhqm-6xhg-59wv https://cve.radiocsirt.org/vuln/gsd-2015-0277 gsd-2015-0277 https://cve.radiocsirt.org/vuln/gsd-2015-0277 https://cve.radiocsirt.org/vuln/rhsa-2015:0846 <p>CLI: Insecure default permissions on history file mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing wss4j: Apache WSS4J is vulnerable to Bleichenbacher&#39;s attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn&#39;t correctly enforce the requireSignedEncryptedDataElements property PicketLink: SP does not take Audience condition of a SAML assertion into account mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion</p> <p>CLI: Insecure default permissions on history file mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing wss4j: Apache WSS4J is vulnerable to Bleichenbacher&#39;s attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn&#39;t correctly enforce the requireSignedEncryptedDataElements property PicketLink: SP does not take Audience condition of a SAML assertion into account mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion</p> https://cve.radiocsirt.org/vuln/rhsa-2015:0846