CVE-2018-0486

Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

• CWE-347

• http://www.securitytracker.com/id/1040177Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/01/msg00016.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-security-announce/2018/msg00007.htmlMailing List, Third Party Advisory
• https://shibboleth.net/community/advisories/secadv_20180112.txtVendor Advisory
• https://www.debian.org/security/2018/dsa-4085Third Party Advisory
• http://www.securitytracker.com/id/1040177Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/01/msg00016.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-security-announce/2018/msg00007.htmlMailing List, Third Party Advisory
• https://shibboleth.net/community/advisories/secadv_20180112.txtVendor Advisory
• https://www.debian.org/security/2018/dsa-4085Third Party Advisory

Published

Jan 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0480A vulnerability in the errdisable per VLAN feature of Cisco …
• CVE-2018-0481A vulnerability in the CLI parser of Cisco IOS XE Software c…6.7
• CVE-2018-0482A vulnerability in the web-based management interface of Cis…5.4
• CVE-2018-0483A vulnerability in Cisco Jabber Client Framework (JCF) could…4.6
• CVE-2018-0484A vulnerability in the access control logic of the Secure Sh…5.3
• CVE-2018-0485A vulnerability in the SM-1T3/E3 firmware on Cisco Second Ge…
• CVE-2018-0487ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 …
• CVE-2018-0488ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0,…
• CVE-2018-0489Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth …
• CVE-2018-0490An issue was discovered in Tor before 0.2.9.15, 0.3.1.x befo…
• CVE-2018-0491A use-after-free issue was discovered in Tor 0.3.2.x before …
• CVE-2018-0492Johnathan Nightingale beep through 1.3.4, if setuid, has a r…