CVE-2018-0489

Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486.

• CWE-347

• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txtThird Party Advisory
• http://www.securityfocus.com/bid/103172Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040435Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/02/msg00031.htmlIssue Tracking
• https://shibboleth.net/community/advisories/secadv_20180227.txtPatch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4126Third Party Advisory
• http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txtThird Party Advisory
• http://www.securityfocus.com/bid/103172Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040435Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/02/msg00031.htmlIssue Tracking
• https://shibboleth.net/community/advisories/secadv_20180227.txtPatch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4126Third Party Advisory

Published

Feb 27, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-0483A vulnerability in Cisco Jabber Client Framework (JCF) could…4.6
• CVE-2018-0484A vulnerability in the access control logic of the Secure Sh…5.3
• CVE-2018-0485A vulnerability in the SM-1T3/E3 firmware on Cisco Second Ge…
• CVE-2018-0486Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth …
• CVE-2018-0487ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 …
• CVE-2018-0488ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0,…
• CVE-2018-0490An issue was discovered in Tor before 0.2.9.15, 0.3.1.x befo…
• CVE-2018-0491A use-after-free issue was discovered in Tor 0.3.2.x before …
• CVE-2018-0492Johnathan Nightingale beep through 1.3.4, if setuid, has a r…
• CVE-2018-0493remctld in remctl before 3.14, when an attacker is authorize…
• CVE-2018-0494GNU Wget before 1.19.5 is prone to a cookie injection vulner…
• CVE-2018-0495Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memo…