Simplesamlphp

Every one of the 23 is a mark on the map. Named now: 1 to 23, most at risk first.

1. The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in wh…CVE-2018-6521Simplesamlphp · 3.1% likely
2. The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allo…CVE-2016-9814Simplesamlphp · 2.4% likely

   CWE-399

3. The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/…CVE-2017-12869Simplesamlphp · 2.4% likely

   CWE-20

4. The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attac…CVE-2017-12868Simplesamlphp · 2.1% likely

   CWE-384

5. SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect pers…CVE-2017-12873Simplesamlphp · 1.7% likely

   CWE-384

6. The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-…CVE-2017-12872Simplesamlphp · 1.5% likely

   CWE-200

7. The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a cr…CVE-2018-7644Simplesamlphp · 1.5% likely

   CWE-347

8. The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.CVE-2016-3124Simplesamlphp · 1.3% likely

   CWE-200

9. Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitr…CVE-2012-0040Simplesamlphp · 1.3% likely

   CWE-79

10. The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the pr…CVE-2017-12867Simplesamlphp · 1.3% likely

    CWE-613

11. Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HT…CVE-2012-0908Simplesamlphp · 1.3% likely

    CWE-79

12. The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScrip…CVE-2017-18121Simplesamlphp · 1.2% likely

    CWE-79

13. HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get inv…CVE-2018-7711Simplesamlphp · 1.2% likely

    CWE-347

14. The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly cause a denial of s…CVE-2016-9955Simplesamlphp · 1.2% likely

    CWE-20

15. A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML respons…CVE-2017-18122Simplesamlphp · 1.1% likely

    CWE-347

16. Information disclosure of source code in SimpleSAMLphpCVE-2020-5301simplesamlphp · CVSS 3 · 0.9% likely

    CWE-200

17. SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDecrypt methods in the…CVE-2017-12870Simplesamlphp · 0.9% likely

    CWE-200

18. SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.CVE-2018-6520Simplesamlphp · 0.9% likely

    CWE-601

19. simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.CVE-2011-4625simplesamlphp · 0.7% likely

    CWE-755

20. Log injection in SimpleSAMLphpCVE-2020-5225simplesamlphp · CVSS 4.4 · 0.7% likely

    CWE-532

21. Cross-site scripting in SimpleSAMLphpCVE-2020-5226simplesamlphp · CVSS 4.4 · 0.5% likely

    CWE-79

22. The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protectio…CVE-2017-12871Simplesamlphp · 0.5% likely

    CWE-326

23. SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`CVE-2026-49284simplesamlphp · CVSS 7.1 · 0.2% likely

    CWE-345

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.