Security Bulletin: Node-forge is vulnerable to security CVEs used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses node-forge which is vulnerable to security CVEs. Vulnerability Details CVEID:CVE-2022-24773 DESCRIPTION: Node.js node-forge module could allow a remote attacker to bypass security restrictions, caused by improper signature verification...

CVE-2022-24771

creationtimestamp| type| source ---|---|--- 2022-10-12 01:06:14+00:00| seen| https://t.me/cibsecurity/39203...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update

Updated images that include numerous enhancements, security, and bug fixes are now available for Red Hat OpenShift Data Foundation 4.11.0 on Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.2.1 containers security update

An update for is now available for OpenShift Service Mesh 2.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use Designer flows may be vulnerable to loss of confidentiality due to CVE-2022-24771

Summary Node.js module node-forge is used by IBM App Connect Enterprise Certified Container by the connectors in a Designer flow to communicate with the connected SaaS application. IBM App Connect Enterprise Certified Container IntegrationServers that run Designer flows containing connectors may ...

CVE-2020-24771

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content...

CVE-2020-24771

CVE-2020-24771 concerns an incorrect access-control vulnerability in the NexusPHP project. Across connected docs, the affected software is NexusPHP 1.5.beta5.20120707, with the core issue described as an access-control error that allows unauthorized attackers to access published content. The Red ...

CVE-2022-24771

A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature...

@arkecosystem/core (>=3.1.0, <=3.2.0), @arkecosystem/core-forger (>=3.1.0, <=3.2.0) +35 more potentially affected by CVE-2022-24771 via node-forge (>=1.0.0, <=1.2.1)

node-forge NPM version =1.0.0, =3.1.0, =3.1.0, =3.1.0, =1.1.26, =1.0.0-jwt-supply-chain.62c7e930.0, =1.0.0 - @hyperledger/cactus-example-carbon-accounting-backend 1.0.0 - @hyperledger/cactus-example-supply-chain-backend 1.0.0 - @hyperledger/cactus-plugin-htlc-coordinator-besu 1.0.0 -...

CVE-2022-24771

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

CVE-2022-24771

CVE-2022-24771 affects Forge (node-forge). Prior to 1.3.0, RSA PKCS#1 v1.5 signature verification is lenient, allowing a crafted DigestInfo structure to steal padding bytes and forge a signature when a low public exponent is used. The issue is fixed in node-forge 1.3.0. Practical impact, as state...

CVE-2022-24771 Improper Verification of Cryptographic Signature in node-forge

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

CVE-2022-24771 Improper Verification of Cryptographic Signature in node-forge

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

CVE-2022-24771 Improper Verification of Cryptographic Signature in node-forge

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

CVE-2022-24771

Removed by vendor...

CVE-2021-24771

creationtimestamp| type| source ---|---|--- 2021-12-13 14:23:59+00:00| seen| https://t.me/cibsecurity/33806...

CVE-2021-24771 Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting

The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when the unfilteredhtml capability is disallo...

CVE-2021-24771

The CVE-2021-24771 entry corresponds to the WordPress Inspirational Quote Rotator plugin (versions up to 1.0.0) with a stored XSS vulnerability. Multiple connected sources confirm that admin users can inject malicious content into quote fields, which is then output in the Quotes list due to insuf...