WS-Attacker

WS-Attacker WS-Attacker es un marco modular para pruebas de penetración de servicios web. Es desarrollado por la Cátedra de Seguridad de Redes y Datos, Universidad Ruhr Bochum https://nds.rub.de/ y Hackmanit GmbH https://hackmanit.de/. La idea básica detrás de WS-Attacker es proporcionar una...

xmlsec

XMLSec Library XMLSec library provides C based implementation for major XML Security standards: XML Signature Syntax and Processing XML Encryption Syntax and Processing Detailed information about supported features and algorithms can be found in the XMLDsig and the XMLEnc interoperability reports...

CVE-2026-100227

The Apache CXF JAX-RS XML Security module is vulnerable to Improper Verification of Cryptographic Signature due to an XML Signature wrapping flaw. Specifically, the XmlSigInHandler , XmlSigInInterceptor , and the streaming XmlSecInInterceptor failed to verify that the XML passed to the applicatio...

CVE-2026-100227 Apache CXF: XML Signature wrapping in JAX-RS XML Security

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...

PT-2026-108810

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper verification of cryptographic signatures in the JAX-RS XML Security module allows for XML Signature wrapping. The...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-6.0 / aspnetcore-targeting-pack-6.0 / dotnet / etc (crlsa-2022_6058)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20226058 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the CIQ...

Linux Distros Unpatched Vulnerability : CVE-2026-92121

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal inside signed content flag permanently set. The...

Rocky Linux 8 [CIQ] Security Update: aspnetcore-runtime-3.1 / aspnetcore-targeting-pack-3.1 / etc Multiple Vulnerabilities (crlsa-2022_6057)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20226057 advisory. dotnet: External Entity Injection during XML signature verification CVE-2022-34716 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: lasso / lasso-debuginfo / lasso-debugsource / lasso-devel (crlsa-2021_4325)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214325 advisory. lasso: XML signature wrapping vulnerability when parsing SAML responses CVE-2021-28091 Tenable has extracted the preceding description block directly from the CIQ...

DEBIAN-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

UBUNTU-CVE-2026-92121

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121

The Apache WSS4J library contains a vulnerability in its streaming (StAX) code . A signature reference utilizing the WS-Security STR-Transform causes an internal "inside signed content" flag to remain permanently set. This leads the WS-SecurityPolicy enforcer to stop evaluating SignedParts and Si...

CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

EUVD-2026-89795

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121 Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

PT-2026-103133

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

CVE-2026-92121: Protection Mechanism Failure

In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...

USN-8770-1 simplesamlphp vulnerabilities

It was discovered that SimpleSAMLphp incorrectly validated cryptographic signatures in XML messages. An authenticated attacker could possibly use this issue to impersonate users or gain elevated privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-3465 It was...