CVE-2015-5253: Undefined Security Weakness

The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."...

CVE-2015-0227: Undefined Security Weakness

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."...

CVE-2012-4418

CVE-2012-4418 concerns Apache Axis2 and its XML signature handling. The provided connected material confirms that this vulnerability arises from the failure to properly verify signed XML messages, allowing an attacker to craft messages that bypass authentication via an XML Signature wrapping atta...

CVE-2012-4418

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

CVE-2012-4418: Improper Authentication

Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

Authentication flaw

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."...

FreeBSD : opensaml2 -- unauthenticated login (9f14cb36-b6fc-11e0-a044-445c73746d79)

OpenSAML developer reports : The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called 'wrapping attack' that allows a remote, unauthenticated...

opensaml2 -- unauthenticated login

OpenSAML developer reports: The Shibboleth software relies on the OpenSAML libraries to perform verification of signed XML messages such as attribute queries or SAML assertions. Both the Java and C++ versions are vulnerable to a so-called "wrapping attack" that allows a remote, unauthenticated...