Filtered by vendor Uninett Subscriptions
Filtered by product Mod Auth Mellon Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-3639 2 Redhat, Uninett 2 Enterprise Linux, Mod Auth Mellon 2024-11-21 6.1 Medium
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
CVE-2017-6807 1 Uninett 1 Mod Auth Mellon 2024-11-21 N/A
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
CVE-2016-2146 2 Fedoraproject, Uninett 2 Fedora, Mod Auth Mellon 2024-11-21 N/A
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.
CVE-2016-2145 2 Fedoraproject, Uninett 2 Fedora, Mod Auth Mellon 2024-11-21 N/A
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
CVE-2014-8567 2 Redhat, Uninett 8 Enterprise Linux, Enterprise Linux Desktop, Enterprise Linux Server and 5 more 2024-11-21 N/A
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
CVE-2014-8566 3 Oracle, Redhat, Uninett 3 Linux, Enterprise Linux, Mod Auth Mellon 2024-11-21 N/A
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."