Approved changes feed: RSS · Atom
cpe:2.3:a:corewcf:corewcf:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Corewcf (32e9e260-38da-5fd2-ac8a-1fea2674ffd0) |
|---|---|
| Product | Corewcf (b75b2f29-d002-5d68-b2c4-6822b785c002) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/corewcf/corewcf |
purl2cpe | 2026-06-01 10:14:40.048801 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54784 |
vulnerable | 2026-07-29 01:00:27.963083 |
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality
HIGH (7.4)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or forge WS-SecureConversation traffic. This issue is fixed in version 1.9.1.
Published: 2026-07-08T22:18:13.846Z
Updated: 2026-07-10T03:55:38.395Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54783 |
vulnerable | 2026-07-29 01:00:27.962893 |
CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages
HIGH (7.4)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. This issue is fixed in versions 1.8.1 and 1.9.1.
Published: 2026-07-08T22:16:08.533Z
Updated: 2026-07-10T03:55:39.889Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54782 |
vulnerable | 2026-07-29 01:00:27.962662 |
CoreWCF: Authentication bypass in CoreWCF SAML 1.1 / 2.0 token signature validation
CRITICAL (10)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated bindings, allowing an unauthenticated remote attacker to impersonate any principal the trusted STS could issue. This issue is fixed in versions 1.8.1 and 1.9.1.
Published: 2026-07-08T22:20:37.401Z
Updated: 2026-07-10T03:55:37.656Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54781 |
vulnerable | 2026-07-29 01:00:27.962543 |
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced
HIGH (7.4)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion. This issue is fixed in versions 1.8.1 and 1.9.1.
Published: 2026-07-08T22:19:40.784Z
Updated: 2026-07-09T14:40:11.234Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54780 |
vulnerable | 2026-07-29 01:00:27.962300 |
CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass
LOW (3.7)
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, the CoreWCF WS-Security 1.0 receive pipeline validates ds:SignedInfo SignatureMethod against the configured SecurityAlgorithmSuite but does not validate each ds:Reference DigestMethod, allowing a sender to use a rejected digest algorithm such as SHA-1 while the message is still accepted. This issue is fixed in versions 1.8.1 and 1.9.1.
Published: 2026-07-08T22:15:06.161Z
Updated: 2026-07-09T19:21:36.312Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54779 |
vulnerable | 2026-07-29 01:00:27.962193 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54778 |
vulnerable | 2026-07-29 01:00:27.962081 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54777 |
vulnerable | 2026-07-29 01:00:27.961971 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54776 |
vulnerable | 2026-07-29 01:00:27.961810 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54775 |
vulnerable | 2026-07-29 01:00:27.961691 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54774 |
vulnerable | 2026-07-29 01:00:27.961560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54773 |
vulnerable | 2026-07-29 01:00:27.961424 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-54772 |
vulnerable | 2026-07-29 01:00:27.961224 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28252 |
vulnerable | 2026-06-08 06:33:26.823600 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.