10228 matches found
CVE-2025-29774
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
@boxyhq/saml-jackson (>=1.3.2, <=1.11.1), @boxyhq/saml20 (>=1.0.11, <=1.2.3) +4 more potentially affected by CVE-2025-29774 via xml-crypto (>=3.0.0, <=3.2.0)
xml-crypto NPM version =3.0.0, =1.3.2, =1.0.11, =1.13.3, =1.13.5, =2.1.0, =1.0.0, =1.0.1 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...
@alexssmusica/emissao-nota-fiscal (>=1.0.0, <=1.0.5), @borodutch-labs/in-app-purchase (1.13.2) +12 more potentially affected by CVE-2025-29774 via xml-crypto (>=2.0.0, <=2.1.5)
xml-crypto NPM version =2.0.0, =1.0.0, =0.1.0-beta.57, =0.2.1-beta.36, =1.14.0, =1.12.1, =0.7.1, =0.0.1, =0.0.9 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...
@boxyhq/saml-jackson (>=1.11.2, <=1.40.2), @boxyhq/saml20 (>=1.2.4, <=1.8.0) +8 more potentially affected by CVE-2025-29774 via xml-crypto (>=4.1.0, <=6.0.0)
xml-crypto NPM version =4.1.0, =1.11.2, =1.2.4, =1.0.0-beta, =4.0.0, =1.0.0, =0.0.1, =0.0.2 - saml-nofs 3.0.2 - verifactu-utils 1.1.0 Source cves: CVE-2025-29774 Source advisory: OSV:GHSA-9P8X-F768-WP2G...
CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
CVE-2025-29775 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
CVE-2025-29775
CVE-2025-29775 : The xml-crypto library for Node.js is vulnerable in versions prior to 6.0.1, 3.2.1, and 2.1.6. An attacker can modify a valid signed XML message in transit such that signature verification still passes, bypassing authentication/authorization checks and enabling privilege escalati...
CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
CVE-2025-29774
CVE-2025-29774 concerns the xml-crypto Node.js library. The issue allows an attacker to modify a valid signed XML message such that signature verification still passes, enabling bypass of authentication/authorization in systems that rely on xml-crypto for verifying signed XML. Affected versions a...
CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...
SUSE CVE-2025-25199
go-crypto-winnative Go crypto backend for Windows using Cryptography API: Next Generation CNG. Prior to commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41, calls to cng.TLS1PRF don't release the key handle, producing a small memory leak every time. Commit f49c8e1379ea4b147d5bff1b3be5b0ff45792e41...
PT-2025-11287
Name of the Vulnerable Software and Affected Versions xml-crypto versions prior to 6.0.1 xml-crypto versions prior to 3.2.1 xml-crypto versions prior to 2.1.6 Description The xml-crypto library for Node.js contains a vulnerability that allows an attacker to modify a valid signed XML message in a...
NPM xml-crypto 数据伪造问题漏洞
NPM xml-crypto is a digital signature and cryptography library from NPM. A security vulnerability exists in NPM xml-crypto version 6.0.0 and earlier that stems from bypassing authentication or authorization mechanisms, allowing an attacker to modify valid signed XML messages...
xml-crypto 数据伪造问题漏洞
NPM xml-crypto is a digital signature and encryption library from NPM. A security vulnerability exists in xml-crypto version 6.0.0 and earlier that stems from bypassing authentication or authorization mechanisms, allowing an attacker to modify valid signed XML messages...
PT-2025-11289 · Unknown · Xml-Crypto
Name of the Vulnerable Software and Affected Versions: xml-crypto versions prior to 6.0.1 xml-crypto versions prior to 3.2.1 xml-crypto versions prior to 2.1.6 Description: The vulnerability in xml-crypto allows an attacker to modify a valid signed XML message in a way that still passes signature...
Security Bulletin: IBM Maximo Application Suite uses "bcprov-jdk18on-1.75.jar" which is vulnerable to CVE-2024-30171
Summary IBM Maximo Application Suite uses "bcprov-jdk18on-1.75.jar" which is vulnerable to CVE-2024-30171. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-30171 DESCRIPTION: The Bouncy Castle Crypto Package For Java could allow ...
Garantex Crypto Exchange Seized, Two Charged in Laundering Scheme
International law enforcement disrupts Garantex, a multi-billion-dollar cryptocurrency exchange used for money laundering. Two individuals, Aleksej Besciokov and…...
Cybercriminals Allegedly Used a StubHub Backdoor to Steal Taylor Swift Tickets
Plus: The world’s “largest illicit online marketplace” gets hit by regulators, police seize the Garantex crypto exchange, and scammers trick targets by making up ransomware attacks...
