Login Request a demo
AP
Vendor
Apereo
12 products with CVEs on record
51
CVEs
0
On KEV
0
New 30D
Products
OP
Opencast
Apereo
10.0
20 CVEs0 on KEV0 new
CA
Central Authentication Service
Apereo
9.8
13 CVEs0 on KEV0 new
PH
phpCAS
apereo
9.8
9 CVEs0 on KEV0 new
BW
Bw-calendar-engine
Apereo
9.0
1 CVEs0 on KEV0 new
BW
Bw-webdav
Apereo
7.5
1 CVEs0 on KEV0 new
CA
cas
apereo
9.1
1 CVEs0 on KEV0 new
CS
Cas Server
Apereo
8.8
1 CVEs0 on KEV0 new
JC
Jasig CAS Client
Apereo
7.4
1 CVEs0 on KEV0 new
JA
Java Apereo CAS Client
Apereo
7.4
1 CVEs0 on KEV0 new
JC
Java Cas Client
Apereo
9.8
1 CVEs0 on KEV0 new
NC
.net Cas Client
Apereo
9.8
1 CVEs0 on KEV0 new
XO
Xerte Online Toolkits
Apereo
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-15243
JA
Java Apereo CAS Client
Apereo
7.4
0%
Jul 24Improper Validation of Certificate in CAS Client
CVE-2026-59099
CA
cas
apereo
9.1
1%
Jul 2Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure
CVE-2026-32985
XO
Xerte Online Toolkits
Apereo
9.8
2%
Mar 20Xerte Online Toolkits <= 3.14 Unauthenticated Template Import Arbitrary File Upload Leading to Remote Code Execution
CVE-2025-61906
OP
Opencast
Apereo
4.3
0%
Oct 8Opencast's editor accidentally publishes videos/overwrites publications #1626
CVE-2025-61788
OP
Opencast
Apereo
5.4
0%
Oct 8Opencast Paella Player 7 vulnerable to Cross-Site-Scripting
CVE-2025-55202
OP
Opencast
Apereo
5.3
0%
Aug 29Opencast is a free, open-source platform to support the management of educational audio and video content
CVE-2025-54380
OP
Opencast
Apereo
6.5
0%
Jul 26Opencast is a free, open-source platform to support the management of educational audio and video content
CVE-2025-3986
CA
Central Authentication Service
Apereo
7.5
1%
Apr 27A vulnerability was found in Apereo CAS 5.2.6
CVE-2025-3985
CA
Central Authentication Service
Apereo
4.9
1%
Apr 27A vulnerability was found in Apereo CAS 5.2.6
CVE-2025-3984
CA
Central Authentication Service
Apereo
7.5
0%
Apr 27A vulnerability was found in Apereo CAS 5.2.6 and classified as critical
CVE-2024-52797
OP
Opencast
Apereo
7.5
1%
Nov 21Opencast is free and open source software for automated video capture and distribution
CVE-2024-11209
CA
Central Authentication Service
Apereo
9.8
1%
Nov 14A vulnerability was found in Apereo CAS 6.6
CVE-2024-11208
CA
Central Authentication Service
Apereo
8.1
1%
Nov 14A vulnerability was found in Apereo CAS 6.6 and classified as problematic
CVE-2024-11207
CA
Central Authentication Service
Apereo
5.4
0%
Nov 14A vulnerability has been found in Apereo CAS 6.6 and classified as problematic
CVE-2024-4399
CA
Central Authentication Service
Apereo
9.1
2%
May 23The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack
CVE-2018-16153
OP
Opencast
Apereo
7.5
1%
Dec 12An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6
CVE-2023-4612
CA
Central Authentication Service
Apereo
9.8
1%
Nov 9Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects…
CVE-2023-28857
CA
Central Authentication Service
Apereo
7.5
1%
Jun 27Apereo CAS is an open source multilingual single sign-on solution for the web
CVE-2022-41965
OP
Opencast
Apereo
6.1
0%
Nov 28Opencast is a free, open-source platform to support the management of educational audio and video content
CVE-2022-39369
PH
phpCAS
apereo
8.0
2%
Nov 1Service Hostname Discovery Exploitation in phpCAS
CVE-2022-29237
OP
Opencast
Apereo
5.4
1%
May 24Opencast is a free and open source solution for automated video capture and distribution at scale
CVE-2021-43821
OP
Opencast
Apereo
7.7
2%
Dec 14Opencast is an Open Source Lecture Capture & Video Management for Education
CVE-2021-43807
OP
Opencast
Apereo
6.5
1%
Dec 14Opencast is an Open Source Lecture Capture & Video Management for Education
CVE-2021-42567
CA
Central Authentication Service
Apereo
6.1
8%
Dec 7Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints
CVE-2021-32623
OP
Opencast
Apereo
6.5
1%
Jun 16Opencast is a free and open source solution for automated video capture and distribution
CVE-2021-21318
OP
Opencast
Apereo
5.4
1%
Feb 18Opencast is a free, open-source platform to support the management of educational audio and video content
CVE-2020-26234
OP
Opencast
Apereo
4.8
0%
Dec 8Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests
CVE-2020-27178
CA
Central Authentication Service
Apereo
7.5
1%
Oct 16Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication
CVE-2020-5231
OP
Opencast
Apereo
6.5
1%
Jan 30In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN
CVE-2020-5206
OP
Opencast
Apereo
10.0
1%
Jan 30In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me…
CVE-2020-5230
OP
Opencast
Apereo
7.5
1%
Jan 30Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used
CVE-2020-5222
OP
Opencast
Apereo
8.8
1%
Jan 30Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key
CVE-2020-5229
OP
Opencast
Apereo
8.1
1%
Jan 30Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm
CVE-2020-5228
OP
Opencast
Apereo
7.5
1%
Jan 30Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH
CVE-2014-4172
NC
.net Cas Client
Apereo
9.8
6%
Jan 24A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before…
CVE-2012-1105
PH
Phpcas
Apereo
5.5
0%
Dec 5An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory
CVE-2012-1104
PH
Phpcas
Apereo
5.3
2%
Dec 5A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed
CVE-2019-10754
CA
Central Authentication Service
Apereo
8.1
2%
Sep 23Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due…
CVE-2018-1000836
BW
Bw-calendar-engine
Apereo
9.0
1%
Dec 20bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of…
CVE-2018-20000
BW
Bw-webdav
Apereo
7.5
2%
Dec 10Apereo Bedework bw-webdav before 4.0.3 allows XXE attacks, as demonstrated by an invite-reply document that reads a local file, related to webdav/servlet/common/MethodBase.java…
CVE-2014-2296
CS
Cas Server
Apereo
8.8
2%
Jul 20XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is…
CVE-2017-1000221
OP
Opencast
Apereo
6.5
1%
Nov 17In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so…
CVE-2017-1000071
PH
Phpcas
Apereo
8.1
4%
Jul 17Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server
CVE-2015-1169
CA
Central Authentication Service
Apereo
–
3%
Feb 10Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a…
CVE-2012-5583
PH
Phpcas
Apereo
–
1%
Jun 6phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2010-3692
PH
Phpcas
Apereo
–
4%
Oct 7Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite…
CVE-2010-3691
PH
Phpcas
Apereo
–
0%
Oct 7PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file
CVE-2010-3690
PH
Phpcas
Apereo
–
3%
Oct 7Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a…