← Back

Apereo

apereo

46 CVEs • 9 products

Products (9)

Click to collapse
Toggle
Opencast
opencast
20 CVEs
Central Authentication Service
central_authentication_service
13 CVEs
Phpcas
phpcas
9 CVEs
Cas Server
cas_server
1 CVE
Bw Webdav
bw-webdav
1 CVE
Bw Calendar Engine
bw-calendar-engine
1 CVE
.net Cas Client
.net_cas_client
1 CVE
Java Cas Client
java_cas_client
1 CVE
Xerte Online Toolkits
xerte_online_toolkits
1 CVE

CVEs (46)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2017-1000071
1Apereo
1Phpcas
May 13, 2026
Jul 17, 2017
N/A· v4
8.1 HIGH· v3
6.8 MEDIUM· v2
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
CVE-2015-1169
1Apereo
1Central Authentication Service
May 6, 2026
Feb 10, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP au...Show more
Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication.Show less
CVE-2012-5583
1Apereo
1Phpcas
May 6, 2026
Jun 6, 2014
N/A· v4
N/A· v3
5.8 MEDIUM· v2
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL...Show more
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Show less
CVE-2010-3692
1Apereo
1Phpcas
Apr 29, 2026
Oct 7, 2010
N/A· v4
N/A· v3
6.4 MEDIUM· v2
Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequence...Show more
Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter.Show less
CVE-2010-3691
1Apereo
1Phpcas
Apr 29, 2026
Oct 7, 2010
N/A· v4
N/A· v3
3.3 LOW· v2
PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file.
CVE-2010-3690
1Apereo
1Phpcas
Apr 29, 2026
Oct 7, 2010
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) p...Show more
Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls.Show less