duo — recent CVEs https://vulnogram.org/ Most recent CVEs assigned by duo (duo). https://vulnogram.org/seaview/icons/duo.png duo — recent CVEs https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT CVE-2018-7340 · 7.7 HIGH — Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal https://vulnogram.org/CVE-2018-7340 https://vulnogram.org/CVE-2018-7340 Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing… High Wed, 17 Apr 2019 14:01:03 GMT CVE-2017-11430 · 7.7 HIGH — Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal https://vulnogram.org/CVE-2017-11430 https://vulnogram.org/CVE-2017-11430 OmniAuth OmnitAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allo… High Wed, 17 Apr 2019 14:00:30 GMT CVE-2017-11429 · 7.7 HIGH — Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal https://vulnogram.org/CVE-2017-11429 https://vulnogram.org/CVE-2017-11429 Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the a… High Wed, 17 Apr 2019 14:00:08 GMT CVE-2017-11428 · 7.7 HIGH — Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal https://vulnogram.org/CVE-2017-11428 https://vulnogram.org/CVE-2017-11428 OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing… High Wed, 17 Apr 2019 13:59:53 GMT CVE-2017-11427 · 7.7 HIGH — Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal https://vulnogram.org/CVE-2017-11427 https://vulnogram.org/CVE-2017-11427 OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing… High Wed, 17 Apr 2019 13:59:19 GMT CVE-2017-11424 https://vulnogram.org/CVE-2017-11424 https://vulnogram.org/CVE-2017-11424 In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA P… Thu, 24 Aug 2017 16:00:00 GMT