CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-49087 – Validation of SignedInfo
https://notcve.org/view.php?id=CVE-2023-49087
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13. xml-security es una librería que implementa cifrado y firmas XML. La validación de una firma XML requiere verificar que el valor hash del documento XML relacionado coincida con un valor DigestValue específico, pero también que la firma criptográfica en el árbol SignedInfo (el que contiene el DigestValue) verifique y coincida con una clave pública confiable. • https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581 https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6r • CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2010-10008 – simplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scripting
https://notcve.org/view.php?id=CVE-2010-10008
A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file templates/trust.tpl.php. The manipulation of the argument StateID leads to cross site scripting. The attack can be launched remotely. • https://github.com/simplesamlphp/simplesamlphp-module-openidprovider/commit/8365d48c863cf06ccf1465cc0a161cefae29d69d https://github.com/simplesamlphp/simplesamlphp-module-openidprovider/releases/tag/v0.9.0 https://vuldb.com/?ctiid.218473 https://vuldb.com/?id.218473 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-10004 – Information Cards Module cross site scripting
https://notcve.org/view.php?id=CVE-2010-10004
A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. • https://github.com/simplesamlphp/simplesamlphp-module-infocard/commit/f6bfea49ae16dc6e179df8306d39c3694f1ef186 https://github.com/simplesamlphp/simplesamlphp-module-infocard/releases/tag/v1.0 https://vuldb.com/?ctiid.217661 https://vuldb.com/?id.217661 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-10002 – SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting
https://notcve.org/view.php?id=CVE-2010-10002
A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. • https://github.com/simplesamlphp/simplesamlphp-module-openid/commit/d652d41ccaf8c45d5707e741c0c5d82a2365a9a3 https://github.com/simplesamlphp/simplesamlphp-module-openid/releases/tag/v1.0 https://vuldb.com/?ctiid.217170 https://vuldb.com/?id.217170 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-38320 – simpleSAMLphp Authentication <= 0.7.0 Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-38320
The simpleSAMLphp Authentication WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.0. El plugin simpleSAMLphp Authentication de WordPress, es vulnerable a un ataque de tipo Cross-Site Scripting Reflejado debido a un valor $_SERVER["PHP_SELF"] reflejado en el archivo ~/simplesamlphp-authentication.php que permite a atacantes inyectar scripts web arbitrario, en versiones hasta 0.7.0 incluyéndola • https://plugins.trac.wordpress.org/browser/simplesamlphp-authentication/tags/0.7.0/simplesamlphp-authentication.php#L307 https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38320 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •