https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:06:35 +0000 https://cve.radiocsirt.org/vuln/cnvd-2015-05644 cnvd-2015-05644 https://cve.radiocsirt.org/vuln/cnvd-2015-05644 https://cve.radiocsirt.org/vuln/euvd-2026-94077 EUVD-2026-94077 https://cve.radiocsirt.org/vuln/euvd-2026-94077 https://cve.radiocsirt.org/vuln/fkie_cve-2015-6254 <p>The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.</p> <p>The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2015-6254 https://cve.radiocsirt.org/vuln/ghsa-cc8r-2q55-6c87 <p>The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.</p> <p>The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows remote attackers to have unspecified impact via unknown vectors. NOTE: this identifier was SPLIT from CVE-2015-0277 per ADT2 due to different vulnerability types.</p> https://cve.radiocsirt.org/vuln/ghsa-cc8r-2q55-6c87 https://cve.radiocsirt.org/vuln/gsd-2015-6254 gsd-2015-6254 https://cve.radiocsirt.org/vuln/gsd-2015-6254 https://cve.radiocsirt.org/vuln/rhsa-2015:0846 <p>CLI: Insecure default permissions on history file mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing wss4j: Apache WSS4J is vulnerable to Bleichenbacher&#39;s attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn&#39;t correctly enforce the requireSignedEncryptedDataElements property PicketLink: SP does not take Audience condition of a SAML assertion into account mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion</p> <p>CLI: Insecure default permissions on history file mod_jk: information leak due to incorrect JkMount/JkUnmount directives processing wss4j: Apache WSS4J is vulnerable to Bleichenbacher&#39;s attack (incomplete fix for CVE-2011-2487) wss4j: Apache WSS4J doesn&#39;t correctly enforce the requireSignedEncryptedDataElements property PicketLink: SP does not take Audience condition of a SAML assertion into account mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion</p> https://cve.radiocsirt.org/vuln/rhsa-2015:0846