ipsilon project vulnerabilities

Products

• ipsilon 3

Latest ipsilon project CVEs

Newest publication first

1. CVE-2016-8638 Session Fixation in ipsilon

   Published 2017-07-12

   Critical·CVSS 9.1 EPSS 2.1%

   A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and term...

2. CVE-2015-5301 Ipsilon denial of service by deleting a SAML2 Service Provider (SP)

   Published 2015-11-17

   Medium·CVSS 5.5

   providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).

3. CVE-2015-5217 Ipsilon denial of service via a duplicate SP name

   Published 2015-11-17

   Medium·CVSS 4.0

   providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service Provider (SP) owner, which allows remote authenticated users to cause a denial of service via a duplicate SP name.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.