| Max CVSS | 6.0 | Min CVSS | 2.1 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2015-0277 | 6.0 |
The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. N
|
12-02-2023 - 23:15 | 17-08-2015 - 20:59 | |
| CVE-2015-0226 | 5.0 |
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via
|
23-07-2019 - 23:15 | 30-10-2017 - 14:29 | |
| CVE-2014-8111 | 5.0 |
Apache Tomcat Connectors (mod_jk) before 1.2.41 ignores JkUnmount rules for subtrees of previous JkMount rules, which allows remote attackers to access otherwise restricted artifacts via unspecified vectors.
|
15-04-2019 - 16:30 | 21-04-2015 - 17:59 | |
| CVE-2015-0227 | 5.0 |
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
|
04-10-2018 - 10:29 | 12-02-2015 - 16:59 | |
| CVE-2014-3586 | 2.1 |
The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak permissions for .jboss-cli-history, which allows local users to obtain sensitiv
|
13-10-2015 - 16:51 | 21-04-2015 - 17:59 | |
| CVE-2015-6254 | 6.0 |
The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in a SAML assertion matches the location from which the message was received, which allows r
|
19-08-2015 - 22:54 | 17-08-2015 - 20:59 |