Most recent entries from all

bdu:2025-04000

certfr-2026-avi-0627 — De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaq…

certfr-2026-avi-0627

EUVD-2026-222915

fkie_cve-2025-29774

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

GHSA-9p8x-f768-wp2g — xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

Affected: npm: xml-crypto

# Impact An attacker may be able to exploit this vulnerability to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user.

# Patches All versions <= 6.0.0 are affected. Please upgrade to version 6.0.1.

If you are still using v2.x or v3.x please upgrade to the associated patch version.

# Indicators of Compromise

When logging XML payloads, check for the following indicators. If the payload includes encrypted elements, ensure you analyze the decrypted version for a complete assessment. (If encryption is not used, analyze the original XML document directly). This applies to various XML-based authentication and authorization flows, such as SAML Response payloads.

### Multiple SignedInfo Nodes There should not be more than one SignedInfo node inside a Signature. If you find multiple SignedInfo nodes, it could indicate an attack.

```xml <Signature> <SomeNode> <SignedInfo> <Reference URI="somefakereference"> <DigestValue>forgeddigestvalue</DigestValue> </Reference> </SignedInfo> </SomeNode> <SignedInfo> <Reference URI="realsignedreference">…

RHSA-2025:3374 — Red Hat Security Advisory: Red Hat Developer Hub 1.5.1 release.

golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html rollup: DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x nanoid: nanoid mishandles non-integer values jinja2: Jinja has a sandbox breakout through malicious filenames jinja2: Jinja has a sandbox breakout through indirect reference to format method systeminformation: Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation undici: Undici Uses Insufficiently Random Values jinja2: Jinja sandbox breakout through attr filter selecting format method xml-crypto: xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References xml-crypto: xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

WID-SEC-W-2025-0705 — HCL BigFix WebUI-Anwendungen: Mehrere Schwachstellen

Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Dateien zu manipulieren, erhöhte Privilegien zu erlangen, einen Denial-of-Service-Zustand auszulösen, vertrauliche Informationen offenzulegen und beliebigen Code auszuführen.