THREATIST.IORead the docs 5 records
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check.
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup.
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources.