CRITICAL9.8CVE-2017-12868SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module >= 1.14.12, < 1.14.14
CRITICAL9.8CVE-2018-6521SimpleSAMLphp Use of insecure connection charset (sqlauth module) from 0, < 1.15.2
CRITICAL9.8Incorrect persistent NameID generation in SimpleSAMLphp
>= 1.7.0, < 1.14.11
HIGH8.1SimpleSAMLphp Signature validation bypass
from 0, < 1.14.17
HIGH7.5SimpleSAMLphp Authentication context bypass in the multiauth module
from 0, < 1.14.14
HIGH7.5simpleSAMLphp incorrectly handles XML encryption
from 0, < 1.8.1
MEDIUM6.3Incorrect signature verification in SimpleSAMLphp
from 0, < 1.14.11
MEDIUM6.1SimpleSAMLphp Open redirection protection bypass
from 0, < 1.15.2
MEDIUM6.1SimpleSAMLphp XSS Vulnerability
>= 1.12.0, < 1.14.16
MEDIUM5.9SimpleSAMLphp Incorrect IV generation for encryption
>= 1.14.0, < 1.14.12
MEDIUM5.9SimpleSAMLphp Unauthenticated encryption in CBC mode
from 0, < 1.14.13
MEDIUM5.9SimpleSAMLphp allows timing side-channel attacks
from 0, < 1.15.0-rc1
MEDIUM5.9SimpleSAMLphp Invalid token creation and validation
>= 1.14.0, < 1.14.15
MEDIUM5.3SimpleSAMLphp Information leakage issue in the sanitycheck module
from 0, < 1.14.1
MEDIUM4.4Cross-site scripting in SimpleSAMLphp
>= 1.18.0, < 1.18.4
MEDIUM4.4Log injection in SimpleSAMLphp
from 0, < 1.18.4
LOW3.0Information disclosure of source code in SimpleSAMLphp
from 0, < 1.18.6