Search for packages
| purl | pkg:composer/simplesamlphp/saml2@0.4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-139j-7afy-wyf1
Aliases: CVE-2019-3465 GHSA-pqm6-cgwr-x6pf |
Improper Input Validation Rob Richards XmlSecLibs, as used for example by SimpleSAMLphp, performs incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. |
Affected by 5 other vulnerabilities. |
|
VCID-ucwf-xdma-h7fc
Aliases: CVE-2018-6519 GHSA-hhm8-2j4g-mpgg |
Injection Vulnerability The SAML2 library in `SimpleSAMLphp` has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp. |
Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-wbt9-snjj-uuea
Aliases: CVE-2018-7644 GHSA-923w-2xv2-7pr8 |
Improper signature validation The `XmlSecLibs` library as used in the saml2 library in SimpleSAMLphp incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue. |
Affected by 2 other vulnerabilities. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-xx6m-pvgs-puga
Aliases: CVE-2018-7711 GHSA-g888-g2pp-82hf |
Incorrect signature validation An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-zemd-kbb3-s3cr
Aliases: CVE-2016-9814 GHSA-r8v4-7vwj-983x |
Incorrect signature verification An incorrect check of return values in the signature validation utilities allows an attacker to get invalid signatures accepted as valid by forcing an error during validation. |
Affected by 5 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||