Advisories · Technology
TIMLEGGE Net::SAML2.
Every CVE that names TIMLEGGE Net::SAML2 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtr…
- TIMLEGGE Net::SAML2
- Weak cryptography or TLS
- CVSS 9.8 CriticalCritical · CVSS 9+
Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an EncryptedAssertion whose decrypted content carries no signature
- TIMLEGGE Net::SAML2
- Weak cryptography or TLS
- CVSS 7.5 High
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
- TIMLEGGE Net::SAML2
- Weak cryptography or TLS