https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:37:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343954 EUVD-2026-343954 https://cve.radiocsirt.org/vuln/euvd-2026-343954 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9487 <p>XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.</p> <p>_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression &#34;//*[@ID=&#39;$id&#39;]&#34; and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.</p> <p>Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.</p> <p>XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.</p> <p>_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression &#34;//*[@ID=&#39;$id&#39;]&#34; and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.</p> <p>Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9487 https://cve.radiocsirt.org/vuln/ghsa-wqp7-2ww4-q6mf <p>XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.</p> <p>_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression &#34;//*[@ID=&#39;$id&#39;]&#34; and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.</p> <p>Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.</p> <p>XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.</p> <p>_get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression &#34;//*[@ID=&#39;$id&#39;]&#34; and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.</p> <p>Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.</p> https://cve.radiocsirt.org/vuln/ghsa-wqp7-2ww4-q6mf