Krajowa Izba Rozliczeniowa

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trus…

SzafirHost downloads necessary files in the context of the initiating web page.

SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from t…

SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but extracts native libraries with JarInputStream parser (reading sequentially from local file headers).

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server.

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection.

Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched.

Szafir is vulnerable to Path Traversal in the uploaded filename.