xmlsec

XMLSec 라이브러리 XMLSec 라이브러리는 주요 XML 보안 표준을 위한 C 기반 구현을 제공합니다: XML 서명 구문 및 처리 XML 암호화 구문 및 처리 지원되는 기능 및 알고리즘에 대한 자세한 정보는 XMLDsig 및 XMLEnc 상호 운용성 보고서에서 확인할 수 있습니다. 문서 XMLSec 라이브러리의 전체 문서는 XMLSec 웹사이트 및 XMLSec GitHub Wiki에 게시되어 있습니다. 라이선스 XMLSec 라이브러리는 MIT 라이선스로 배포됩니다 Copyright 파일 참조. XMLSec 빌드 및 설치 자...

WS-Attacker

WS-Attacker WS-Attacker는 웹 서비스 침투 테스트를 위한 모듈형 프레임워크입니다. Ruhr University Bochum의 네트워크 및 데이터 보안 연구실Chair of Network and Data Security, https://nds.rub.de/과 Hackmanit GmbHhttps://hackmanit.de/가 개발했습니다. WS-Attacker의 기본 아이디어는 WSDL 파일을 로드하고 SOAP 메시지를 웹 서비스 엔드포인트로 전송하는 기능기본 SoapUI 프레임워크를 사용하여 실행됨을 제공하는...

USN-8770-1: SimpleSAMLphp vulnerabilities

It was discovered that SimpleSAMLphp incorrectly validated cryptographic signatures in XML messages. An authenticated attacker could possibly use this issue to impersonate users or gain elevated privileges. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. CVE-2019-3465 It was...

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

EUVD-2026-75632

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89043

passport-saml-encrypted through version 0.1.13 is affected by an XML signature wrapping vulnerability. The root cause is that signature verification and assertion extraction use independent XPath lookups with no cross-validation (see saml.js lines 256 and 328). An attacker holding any validly sig...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-49289

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

EUVD-2026-62505

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-49289

The simplesamlphp/saml2 library (versions 4.19.2 and 4.20.2) permits attacker-controlled XPath transforms during XML signature processing, allowing a remote unauthenticated attacker to consume excessive resources and cause denial of service. The fix caps transform count and rejects XPath transfor...

CVE-2026-49289 SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources,...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig for Perl versions prior to 0.72 is vulnerable: verify() can return true without performing any digest or signature checks when multiple signatures are present or id_attr mismatch occurs, effectively bypassing signature verification. Affected range includes 0.29–0.71 (up to 0.28 is not af...

EUVD-2026-52325

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

CVE-2026-9390

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify and getsignedxml in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName...