544 matches found
CVE-2017-1000452
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...
CVE-2017-1000452
CVE-2017-1000452 affects Samlify (≤2.2.0) and the predecessor Express-saml2. It describes an XML Signature Wrapping vulnerability that could allow an attacker to impersonate arbitrary users. Reported impact includes high confidentiality, integrity, and availability concerns; exploitation is descr...
CVE-2017-1000452
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...
CVE-2017-1000452
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...
CVE-2017-1000452: XML Injection (aka Blind XPath Injection)
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users...
PT-2018-5219
Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.4.0-rc5 Express-saml2 affected versions not specified samlify version 2.2.0 and earlier Description An issue exists that could allow attackers to impersonate arbitrary users by modifying SAML content for a SAML...
WS-Attacker v1.8 - Modular Framework For Web Services Penetration Testing
WS-Attacker is a modular framework for web services penetration testing. It is developed by the Chair of Network and Data Security, Ruhr University Bochum http://nds.rub.de/ and the Hackmanit GmbH http://hackmanit.de/ . The basic idea behind WS-Attacker is to provide a functionality to load WSDL...
See how I through subdomain takeover to bypass the Uber Single Sign-On authentication mechanism-vulnerability warning-the black bar safety net
! Uber to use the Amazon CloudFront CDN architecture website saostatic. uber. com there is a subdomain of the security vulnerability, an attacker take over. In addition, Uber recently deployed in the site auth. uber. com, based on Uber all the subdomain cookie sharing to achieve authentication of...
Code injection
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
Code injection
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3931
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3931
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3931
CVE-2015-3931 affects Microsec e-Szigno (older than 3.2.7.12). The issue is XML Signature Wrapping: an inserted ds:Object payload can cause a valid signature to be displayed for a different document, enabling tampering with digitally signed files. Affected versions are older than 3.2.7.12; fixed ...
CVE-2015-3932
Netlock Mokka before 2.7.8.1204 is affected by an XML signature wrapping vulnerability. An attacker can insert a crafted ds:Object payload into an e-akta signed document, causing signature validation to misrepresent the content. Exploitation context is not detailed in the provided documents, and ...
CVE-2015-3932
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3931: XML Injection (aka Blind XPath Injection)
Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
CVE-2015-3932: XML Injection (aka Blind XPath Injection)
Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML signature wrapping attacks via an e-akta signed document with a ds:Object node with a crafted payload prepended to a valid ds:Object...
PT-2017-6709
Name of the Vulnerable Software and Affected Versions Netlock Mokka versions prior to 2.7.8.1204 Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload...
PT-2017-6708
Name of the Vulnerable Software and Affected Versions Microsec e-Szigno versions prior to 3.2.7.12 Description The issue allows remote attackers to perform XML signature wrapping attacks. This can be achieved via an e-akta signed document with a ds:Object node that contains a crafted payload...