Jonatan Männchen / EEF

Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Purpose-limited JWT accepted as full bearer authentication in AshAuthentication

HTTP/2 connection-window starvation pins Plug processes indefinitely in Bandit

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

CDATA Section Breakout via Unsanitised ]]> in xml_builder

Element and Attribute Names Injected Verbatim into XML Output in xml_builder

Round-trip Corruption via Improper Entity Escaping in xml_builder

Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race