https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:56:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-07261 bdu:2024-07261 https://cve.radiocsirt.org/vuln/bdu:2024-07261 https://cve.radiocsirt.org/vuln/bit-gitlab-2024-45409 <p><strong>Affected:</strong> Bitnami: gitlab</p> <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> <p><strong>Affected:</strong> Bitnami: gitlab</p> <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> https://cve.radiocsirt.org/vuln/bit-gitlab-2024-45409 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0791 certfr-2024-avi-0791 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0791 https://cve.radiocsirt.org/vuln/euvd-2026-200631 EUVD-2026-200631 https://cve.radiocsirt.org/vuln/euvd-2026-200631 https://cve.radiocsirt.org/vuln/fkie_cve-2024-45409 <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-45409 https://cve.radiocsirt.org/vuln/ghsa-jw9c-mfg7-9rx2 <p><strong>Affected:</strong> RubyGems: ruby-saml</p> <p>Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.</p> <p>This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)</p> <p><strong>Affected:</strong> RubyGems: ruby-saml</p> <p>Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.</p> <p>This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)</p> https://cve.radiocsirt.org/vuln/ghsa-jw9c-mfg7-9rx2 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-45409 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ruby-saml, Ubuntu:Pro:18.04:LTS: ruby-saml, Ubuntu:20.04:LTS: ruby-saml, Ubuntu:22.04:LTS: ruby-saml, Ubuntu:24.04:LTS: ruby-saml</p> <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: ruby-saml, Ubuntu:Pro:18.04:LTS: ruby-saml, Ubuntu:20.04:LTS: ruby-saml, Ubuntu:22.04:LTS: ruby-saml, Ubuntu:24.04:LTS: ruby-saml</p> <p>The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in &lt;= 12.2 and 1.13.0 &lt;= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system. This vulnerability is fixed in 1.17.0 and 1.12.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-45409 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2162 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GitLab und Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GitLab und Ruby ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2162