Advisories · Technology
TIMLEGGE XML::Sig.
Every CVE that names TIMLEGGE XML::Sig among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check
- TIMLEGGE XML::Sig
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
- TIMLEGGE XML::Sig
- Weak cryptography or TLS
- CVSS 9.1 CriticalCritical · CVSS 9+
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
- TIMLEGGE XML::Sig
- Other injection
- CWE-1287
- CVSS 9.3 CriticalCritical · CVSS 9+
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
- TIMLEGGE XML::Sig
- Weak cryptography or TLS