Login Request a demo
SH
Vendor
Shibboleth
10 products with CVEs on record
23
CVEs
0
On KEV
0
New 30D
Products
SP
Service Provider
Shibboleth
9.1
8 CVEs0 on KEV0 new
IP
Identity Provider
Shibboleth
7.5
3 CVEs0 on KEV0 new
OP
Opensaml
Shibboleth
8.1
3 CVEs0 on KEV0 new
OJ
Opensaml Java
Shibboleth
5.9
2 CVEs0 on KEV0 new
XM
Xmltooling-c
Shibboleth
6.5
2 CVEs0 on KEV0 new
OO
Oidc OP
Shibboleth
8.2
1 CVEs0 on KEV0 new
OC
OpenSAML C++ library
Shibboleth
4.0
1 CVEs0 on KEV0 new
SH
Shibboleth-identity-provider
Shibboleth
–
1 CVEs0 on KEV0 new
SH
Shibboleth-sp
Shibboleth
–
1 CVEs0 on KEV0 new
XM
Xmltooling
Shibboleth
7.5
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-9943
SP
Service Provider
Shibboleth
9.1
0%
Sep 10Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider
CVE-2025-31335
OC
OpenSAML C++ library
Shibboleth
4.0
0%
Mar 28The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures)
CVE-2023-36661
XM
Xmltooling
Shibboleth
7.5
3%
Jun 25Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element
CVE-2023-22947
SP
Service Provider
Shibboleth
7.3
0%
Jan 11Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM…
CVE-2022-24129
OO
Oidc OP
Shibboleth
8.2
6%
Feb 4The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter
CVE-2021-31826
SP
Service Provider
Shibboleth
7.5
2%
Apr 27Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature
CVE-2021-28963
SP
Service Provider
Shibboleth
5.3
1%
Mar 22Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters
CVE-2020-27978
IP
Identity Provider
Shibboleth
7.5
2%
Oct 28Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw
CVE-2019-19191
SP
Service Provider
Shibboleth
7.8
0%
Nov 21Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlled by the service user (the shibd account) after…
CVE-2010-2450
SP
Service Provider
Shibboleth
7.5
1%
Nov 7The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm
CVE-2014-3603
IP
Identity Provider
Shibboleth
5.9
1%
Apr 4The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server…
CVE-2018-0489
XM
Xmltooling-c
Shibboleth
6.5
2%
Feb 27Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows…
CVE-2018-0486
XM
Xmltooling-c
Shibboleth
6.5
2%
Jan 13Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data,…
CVE-2017-16853
OP
Opensaml
Shibboleth
8.1
1%
Nov 16The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the…
CVE-2017-16852
SP
Service Provider
Shibboleth
8.1
1%
Nov 16shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the…
CVE-2015-1796
IP
Identity Provider
Shibboleth
–
1%
Jul 8The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are…
CVE-2015-2684
SP
Service Provider
Shibboleth
–
2%
Mar 31Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message
CVE-2013-6440
OP
Opensaml
Shibboleth
–
3%
Feb 14The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to…
CVE-2011-1411
OP
Opensaml
Shibboleth
–
2%
Sep 2Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML…
CVE-2011-2516
SH
Shibboleth-sp
Shibboleth
–
8%
Jul 11Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to…