SP
Product
Service Provider
8
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 1Low 0
Watch
Add Service Provider to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-9943 | 9.1 | Sep 10 | Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider Affected: through 3.5.0 |
| CVE-2017-16852 | 8.1 | Nov 16 | shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the… Affected: before 2.6.1 |
| CVE-2019-19191 | 7.8 | Nov 21 | Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after… Affected: 3.0.0 before 3.1.0 |
| CVE-2021-31826 | 7.5 | Apr 27 | Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature Affected: 3.0.0 before 3.2.2 |
| CVE-2010-2450 | 7.5 | Nov 7 | The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm Affected: 2.0 |
| CVE-2023-22947 | 7.3 | Jan 11 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM… Affected: before 3.4.1 |
| CVE-2021-28963 | 5.3 | Mar 22 | Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters Affected: before 3.2.1 |
| CVE-2015-2684 | – | Mar 31 | Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message Affected: through 2.5.3 |
Showing 8