Lucene search
+L

294 matches found

OSV
OSV
•added 2020/01/13 7:15 p.m.•34 views

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.5AI score
SaveExploits0References8
OSV
OSV
•added 2020/01/13 7:15 p.m.•1 views

DEBIAN-CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.6AI score0.01223EPSS
SaveExploits0References1
NVD
NVD
•added 2020/01/13 7:15 p.m.•32 views

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.5AI score0.01223EPSS
SaveExploits0References8
Prion
Prion
•added 2020/01/13 7:15 p.m.•14 views

Information disclosure

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

5CVSS7.4AI score0.01223EPSS
SaveExploits0References8Affected Software3
PyPA
PyPA
•added 2020/01/13 7:15 p.m.•11 views

PYSEC-2020-94

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS6.8AI score0.01223EPSS
SaveExploits0References9Affected Software1
UbuntuCve
UbuntuCve
•added 2020/01/13 7:15 p.m.•22 views

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7AI score0.01223EPSS
SaveExploits0References7
OSV
OSV
•added 2020/01/13 7:15 p.m.•10 views

UBUNTU-CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.1AI score0.01223EPSS
SaveExploits0References8
OSV
OSV
•added 2020/01/13 7:15 p.m.•30 views

PYSEC-2020-94

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS1.7AI score0.01223EPSS
SaveExploits0References9
attackerkb
attackerkb
•added 2020/01/13 7:15 p.m.•6 views

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.4AI score0.01223EPSS
SaveExploits0References11
Debian CVE
Debian CVE
•added 2020/01/13 6:11 p.m.•80 views

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

7.5CVSS7.6AI score0.01223EPSS
SaveExploits0
Positive Technologies
Positive Technologies
•added 2020/01/09 12:00 a.m.•9 views

PT-2020-5164

Name of the Vulnerable Software and Affected Versions PySAML2 versions prior to 5.0.0 Description The issue is related to incorrect verification of cryptographic signatures in SAML2 documents, allowing a remote attacker to bypass signature checks and access protected information. This is due to t...

8.7CVSS7.5AI score0.01223EPSS
SaveExploits0References133
nodejs
nodejs
•added 2019/06/14 4:46 p.m.•32 views

Authentication Bypass

Overview Versions of samlify prior to 2.4.0 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the...

7.2AI score
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
•added 2018/06/17 1:05 p.m.•34 views

Security Bulletin: Vulnerabilities in WSS4J affects IBM Cúram (CVE-2015-0226 & CVE-2015-0227 )

Summary IBM Cúram is shipped with a third party library called WSS4J, which is vulnerable to an attack on XML Encryption. WSS4J also fails to properly enforce the requireSignedEncryptedDataElements property which leaves it vulnerable to XML Signature wrapping attacks . Vulnerability Details CVEID...

7.5CVSS0.3AI score0.07543EPSS
SaveExploits0Affected Software1
Hacker One
Hacker One
•added 2018/05/23 7:11 a.m.•114 views

Node.js third-party modules: Samlify is vulnerable to signature wrapping

I would like to report a signature wrapping weakness in samlify It allows an attacker to modify a SAML token received from the IdP before validating it with the service provider Module module name: samlify version: 2.3.7 npm page: https://www.npmjs.com/package/samlify Module Description Highly...

6.8AI score
SaveExploits0
Github Security Blog
Github Security Blog
•added 2018/01/04 9:03 p.m.•45 views

Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

7.5CVSS7.6AI score0.0138EPSS
SaveExploits0References7Affected Software1
OSV
OSV
•added 2018/01/04 9:03 p.m.•64 views

GHSA-8JJF-W7J6-323C Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic...

7.5CVSS7.7AI score0.0138EPSS
SaveExploits0References7
Veracode
Veracode
•added 2018/01/03 4:54 a.m.•21 views

XML Signature Wrapping

Samlify and express-saml2 are vulnerable to XML signature wrapping attacks. Attackers who observe SAML responses are able to add NameID's to the response without breaking the signature check. This could allow them to login as any user...

7.5CVSS7.3AI score0.0138EPSS
SaveExploits0References2Affected Software2
OSV
OSV
•added 2018/01/02 5:29 p.m.•21 views

CVE-2017-1000452

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

7.5CVSS7.7AI score
SaveExploits0References2
Prion
Prion
•added 2018/01/02 5:29 p.m.•23 views

Design/Logic Flaw

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

6CVSS7.5AI score0.0138EPSS
SaveExploits0References2Affected Software1
NVD
NVD
•added 2018/01/02 5:29 p.m.•32 views

CVE-2017-1000452

An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...

7.5CVSS7.5AI score0.0138EPSS
SaveExploits0References2
Rows per page
Query Builder