Xmltooling Project Xmltooling vulnerabilities
8 known vulnerabilities affecting xmltooling_project/xmltooling.
Total CVEs
8
CISA KEV
0
Public exploits
1
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH3MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2023-36661HIGHCVSS 7.5PoC≥ 0, < 3.2.0-3+deb11u1≥ 0, < 3.2.3-1+deb12u1+1 more2023-06-25
CVE-2023-36661 [HIGH] CVE-2023-36661: Shibboleth XMLTooling before 3
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
osv
CVE-2019-9628HIGHCVSS 7.5fixed in 3.0.42019-04-11
CVE-2019-9628 [HIGH] CWE-755 CVE-2019-9628: The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Servi
The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
nvdosv
CVE-2018-0489MEDIUMCVSS 6.5≥ 0, < 1.6.4-12018-02-27
CVE-2018-0489 [MEDIUM] CVE-2018-0489: Shibboleth XMLTooling-C before 1
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.
osv
CVE-2018-0486MEDIUMCVSS 6.5≥ 0, < 1.6.3-12018-01-13
CVE-2018-0486 [MEDIUM] CVE-2018-0486: Shibboleth XMLTooling-C before 1
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.
osv
CVE-2015-0851MEDIUMCVSS 5.0≤ 1.5.42015-08-12
CVE-2015-0851 [MEDIUM] CWE-189 CVE-2015-0851: XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not prop
XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data.
nvdosv
CVE-2009-3476CRITICALCVSS 9.3≥ 0, < 1.2.2-12009-09-29
CVE-2009-3476 [CRITICAL] CVE-2009-3476: Buffer overflow in OpenSAML before 1
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
osv
CVE-2009-3474HIGHCVSS 7.5≥ 0, < 1.2.2-12009-09-29
CVE-2009-3474 [HIGH] CVE-2009-3474: OpenSAML 2
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate.
osv
CVE-2009-3475MEDIUMCVSS 5.9≥ 0, < 1.2.2-12009-09-29
CVE-2009-3475 [MEDIUM] CVE-2009-3475: Internet2 Shibboleth Service Provider software 1
Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1, when using PKIX trust validation, does not properly handle a '\0' character in the subject or subjectAltName fields of a certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
osv