60 matches found
CVE-2026-88920
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...
CVE-2026-88920 Apache WSS4J: SAML Sender-Vouches Authentication Bypass
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0...
CVE-2026-88920
A flaw in the DOM security processor of Apache WSS4J allows unauthenticated remote attackers to perform an authentication bypass . By submitting a crafted, unsigned SAML sender-vouches assertion containing an attacker-controlled key, an attacker can forge authenticated SOAP messages . To mitigate...
CVE-2026-54783 CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with...
CVE-2026-54783
CoreWCF (Net Core port of WCF) has an XML Signature Wrapping vulnerability in WS-Security endorsing/signature verification prior to v1.8.1 and v1.9.1, where the ds:Signature may not cover the expected Security header target. An attacker who captures a signed SOAP envelope can replay arbitrary ser...
Improper Verification of Cryptographic Signature
Overview CoreWCF.Primitives is a port of the service side of Windows Communication Foundation WCF to .NET Core. The goal of this project is to enable existing WCF services to move to .NET Core. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in...
Improper Security Configuration
Spring Web Services is vulnerable to Improper Security Configuration. The vulnerability is due to Wss4jSecurityInterceptor disabling WS-I Basic Security Profile BSP enforcement during inbound WS-Security validation by default, allowing SOAP messages that violate BSP security requirements to be...
Insecure Defaults
Overview Affected versions of this package are vulnerable to Insecure Defaults due to the Wss4jSecurityInterceptor class in Wss4jSecurityInterceptor.java initializing its bspCompliant flag to false, so inbound validation always calls RequestData.setDisableBSPEnforcementtrue and disables WSS4J's...
Konica Bizhub Multifunction Printers Incorrect Authorization (CVE-2021-20868)
If external server authentication is used, a remote attacker with administrative privileges could steal user credentials by sending specific SOAP messages. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504865; scriptversion"1.2";...
Konica Bizhub Multifunction Printers Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-20869)
When using external authentication with an LDAP server, a remote attacker could steal specific authentication information in Administrator settings by sending specific SOAP messages. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504863; scriptversion"1.2";...
CVE-2025-41722 Sauter: Hard-coded Authentication Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...
CVE-2025-41722 Sauter: Hard-coded Authentication Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...
EUVD-2012-4009
Malware in sbrugna...
EUVD-2020-17948
Malware in sbrugna...
EUVD-2013-0493
Malware in sbrugna...
EUVD-2021-21517
Malware in sbrugna...
EUVD-2011-1330
Malware in sbrugna...
EUVD-2022-1896
Malicious code in bioql PyPI...