446 matches found
CVE-2025-66567 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, generating entirely different...
CVE-2025-66567
The CVE-2025-66567 issue affects ruby-saml, where versions up to and including 1.12.4 implement a SAML SSO client but contain an authentication bypass due to an incomplete fix for CVE-2025-25292. The root cause is a parser differential: ReXML and Nokogiri parse XML differently, producing differen...
GHSA-9V8J-X534-2FX3 Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker...
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker...
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
Summary Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker...
Exploring Hidden Geographic Disparities in Android Apps
While mobile app evolution has been widely studied, geographical variation in app behavior remains largely unexplored. This paper presents a large-scale study of location-based Android app differentiation, uncovering two important and underexamined phenomena with security and fairness implication...
AWS Bedrock Prompt Caching Support in Spring AI
In our previous blog post about Anthropic prompt caching, we explored how prompt caching dramatically reduces API costs and latency by reusing previously processed prompt content. We introduced Spring AI's five strategic caching patterns for Anthropic Claude models and showed how they automatical...
Information Disclosure
Liferay Portal is vulnerable to Information Disclosure. The vulnerability is due to improper handling of object entry enumeration responses, which allows an attacker to determine the existence of specific External Reference Codes ERC in the application by exploiting response time differences...
When AI Takes the Wheel: Security Analysis of Framework-Constrained Program Generation
In recent years, the AI wave has grown rapidly in software development. Even novice developers can now design and generate complex framework-constrained software systems based on their high-level requirements with the help of Large Language Models LLMs. However, when LLMs gradually "take the whee...
When Face Recognition Doesn’t Know Your Face Is a Face
An estimated 100 million people live with facial differences. As face recognition tech becomes widespread, some say they’re getting blocked from accessing essential systems and services...
IBM Aspera 安全漏洞
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. An information disclosure vulnerability exists in IBM Aspera that stems from an observable difference in the returned data, which can be exploited by an...
EUVD-2005-4752
Malware in sbrugna...
EUVD-2012-2753
Malware in sbrugna...
EUVD-2013-4343
Malware in sbrugna...
EUVD-2019-4874
Malware in sbrugna...
EUVD-2006-0404
Malware in sbrugna...
EUVD-2013-4876
Malware in sbrugna...
EUVD-2014-2282
Malware in sbrugna...