Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2841▼ 157 respecto a la semana anterior
Críticas / altas1370▲ 51 respecto a la semana anterior
Nueva explotación activa (KEV)5▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)266▼ 258 respecto a la semana anterior
7 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (7.5) | 2.9% | — | Shibboleth XmltoolingDebian Linux | 25/6/2023 | 17/6/2026 | Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.) | |
| Modificada | Alta (7.5) | 2.1% | — | Xmltooling Project XmltoolingCanonical Ubuntu LinuxOpensuse Leap | 11/4/2019 | 17/6/2026 | The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type. | |
| Modificada | Media (6.5) | 2.1% | — | Shibboleth Xmltooling-cDebian LinuxArubanetworks Clearpass | 27/2/2018 | 17/6/2026 | Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of… | |
| Modificada | Media (6.5) | 1.5% | — | Shibboleth Xmltooling-cDebian Linux | 13/1/2018 | 17/6/2026 | Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. | |
| Modificada | Media (5) | 2.4% | — | Xmltooling Project Xmltooling | 12/8/2015 | 17/6/2026 | XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data. | |
| Modificada | Alta (9.3) | 4.1% | — | Internet2 Shibboleth-spInternet2 OpensamlInternet2 Xmltooling | 29/9/2009 | 16/6/2026 | Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a… | |
| Modificada | Alta (7.5) | 1.5% | — | Internet2 OpensamlInternet2 XmltoolingInternet2 Shibboleth-sp | 29/9/2009 | 16/6/2026 | OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose,… |