169 matches found
CVE-2015-3931
CVE-2015-3931 affects Microsec e-Szigno (older than 3.2.7.12). The issue is XML Signature Wrapping: an inserted ds:Object payload can cause a valid signature to be displayed for a different document, enabling tampering with digitally signed files. Affected versions are older than 3.2.7.12; fixed ...
CVE-2015-3931: XML Injection (aka Blind XPath Injection)
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3932: XML Injection (aka Blind XPath Injection)
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
PT-2017-6709
Name of the Vulnerable Software and Affected Versions Netlock Mokka versions prior to 2.7.8.1204 Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload...
PT-2017-6708
Name of the Vulnerable Software and Affected Versions Microsec e-Szigno versions prior to 3.2.7.12 Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload...
CVE-2016-5697
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...
CVE-2016-5697
CVE-2016-5697 concerns the Ruby-saml library before version 1.3.0, where improper handling of SAML signatures allows XML signature wrapping attacks via unspecified vectors. The vulnerability can enable an unauthenticated attacker to impersonate a user by abusing how SAML responses are validated (...
CVE-2016-5697
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...
CVE-2016-5697: XML Injection (aka Blind XPath Injection)
Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors...
PT-2017-8747 · Ruby +2 · Ruby-Saml +2
Name of the Vulnerable Software and Affected Versions: ruby-saml versions prior to 1.3.0 Description: The issue allows attackers to perform XML signature wrapping attacks. This occurs in a specific scenario where a signature references two elements simultaneously, one of which is inside an...
XML Signature Wrapping Attack
pyxmlsecurity is vulnerable to XML signature wrapping attacks. A flaw in the verify function allows attackers to modify the message by injecting forged elements which do not invalidate the XML Signature...
Unspecified vulnerability in RubyGems ruby-saml
RubyGems ruby-saml is a set of SAML Security Assertion Markup Language development toolkits for the Ruby on Rails framework organized by RubyGems. A security vulnerability exists in RubyGems Ruby-saml versions prior to 1.3.0. An attacker could exploit this vulnerability to perform an XML signatur...
ruby-saml -- XML signature wrapping attack
RubySec reports: ruby-saml prior to version 1.3.0 is vulnerable to an XML signature wrapping attack in the specific scenario where there was a signature that referenced at the same time 2 elements but past the scheme validator process since 1 of the element was inside the encrypted assertion...
Web Services Penetration Testing: WS-Attacker
WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum http://nds.rub.de/ and the Hackmanit GmbH http://hackmanit.de/ . The basic idea behind WS-Attacker is to provide a functionality to load WSDL...
CVE-2015-3931 Microsec e-Szigno, CVE-2015-3932 Netlock Mokka XSW vulnerability
In November 2014, SEARCH-LAB Ltd. discovered a security vulnerability in Microsec e-Szigno, and Netlock Mokka computer applications that are used to generate and validate digital signatures, which are applied within the official Hungarian government processes. The vulnerability affected the...
WS-Attacker - Modular Framework for Web Services Penetration Testing
XML-based SOAP Web Services are a widely used technology, which allows the users to execute remote operations and transport arbitrary data. It is currently adapted in Service Oriented Architectures, cloud interfaces, management of federated identities, eGovernment, or millitary services. The wide...
wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property
It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...
CVE-2012-4418
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...
