CVE-2022-39299_PoC_Generator

CVE-2022-39299 का शोषण एकाधिक रूट तत्वों के माध्यम से हस्ताक्षर बाईपास परामर्श : https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 पैच : https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e node-saml परीक्षण मामलों से निकाला ग...

EUVD-2021-1569

Malware in sbrugna...

EUVD-2022-7124

Malicious code in bioql PyPI...

@digabi/passport-utils (>=0.0.1, <=0.0.2), cloudcms-server (>=3.2.324, <=4.0.0-beta.22) potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=5.0.0, <=5.0.1)

@node-saml/passport-saml NPM version =5.0.0, =0.0.1, =3.2.324, =4.0.0-beta.22 Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

@andreacioni/saml2-nest-lib (>=0.0.2, <=0.0.7), @backstage/plugin-auth-backend (>=0.0.0-nightly-2021101022158, <=0.12.3) +51 more potentially affected by CVE-2025-54419 via passport-saml (>=3.2.0, <=3.2.4)

passport-saml NPM version =3.2.0, =0.0.2, =0.0.0-nightly-2021101022158, =0.0.0-nightly-202201422556, =0.1.0, =0.1.0, =0.4.0, =0.2.1, =0.35.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3 and more Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

CVE-2021-39171

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...

CVE-2022-39299

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass SAML authentication due to passport-saml ( CVE-2022-39299 )

Summary Passport-saml is used by IBM Cloud Pak for Data for SAML authentication. CVE-2022-39299. Vulnerability Details CVEID:CVE-2022-39299 DESCRIPTION: Node.js passport-saml module could allow a remote attacker to bypass security restrictions, caused by improper verification of cryptographic...

Exploit for Improper Verification of Cryptographic Signature in Passport-Saml_Project Passport-Saml

Exploiting CVE-2022-39299 Signature bypass via multiple ro...

Improper Verification Of Cryptographic Signature

Passport-saml is vulnerable to improper cryptographic signature verification. A remote attacker is able to bypass SAML authentication via an arbitrary IDP signed XML element, due to improper checks for a valid top-level signature in saml.ts...

CVE-2022-39300

node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the...

CVE-2022-39300 Signature bypass via multiple root elements in node-SAML

node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the...

node-saml 数据伪造问题漏洞

node-saml is a SAML library that does not depend on any framework running in Node.js. A data forgery issue vulnerability exists in versions prior to node-saml 4.0.0-beta.5, which can be exploited by an attacker to bypass SAML authentication on a website using passport-saml...

GHSA-5P8W-2MVW-38PV Signature bypass via multiple root elements

Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid user...

hapi-saml2 (>=3.2.0, <=3.2.1), tensor-cloudnative-express-auth (>=1.0.69, <=2.0.6) potentially affected by CVE-2022-39299 via passport-saml (3.2.0)

passport-saml NPM version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on passport-saml and may be impacted: - hapi-saml2 =3.2.0, =1.0.69, =2.0.6 Source cves: CVE-2022-39299 Source advisory: OSV:GHSA-M974-647V-WHV7...

Signature bypass via multiple root elements

Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid user...

GHSA-M974-647V-WHV7 Signature bypass via multiple root elements

Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid user...

CVE-2022-39299

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...

Authentication flaw

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...

CVE-2022-39299

CVE-2022-39299 affects the passport-saml library (Node.js) and allows remote authentication bypass via improper verification of cryptographic signatures in SAML responses. A attacker must present an arbitrary IDP-signed XML element; depending on IdP, fully unauthenticated access may be feasible i...