PT-2022-23036 · Unknown · Policycontroller

Name of the Vulnerable Software and Affected Versions: PolicyController versions prior to 0.2.1 Description: The issue arises when there is at least one attestation with a valid signature and no attestations of the type being verified, with --type defaulting to "custom". This results in a false...

cosign 数据伪造问题漏洞

cosign is a container signing, verification and storage in an OCI registry in the United States. A data forgery issue vulnerability exists in versions prior to cosign 1.10.1, which stems from the fact that the cosign verify-attestation --type may report a false positive if any attestation is...

CVE-2022-1740

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

CVE-2022-1740

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

Design/Logic Flaw

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

CVE-2022-1740 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

CVE-2022-1740

The CVE-2022-1740 vulnerability in Dominion Voting Systems ImageCast X concerns the on-screen hash display, audit log export, and application export features that rely on self-attestation. The root cause is mutable attestation/measurement data, allowing an attacker with access to disguise malicio...

CVE-2022-1740 2.2.2 MUTABLE ATTESTATION OR MEASUREMENT REPORTING DATA CWE-1283

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export, and application export functionality rely on self-attestation mechanisms. An attacker could leverage this vulnerability to disguise malicious applications on a device...

MAL-2022-4153 Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in keyvault-mock-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 343541e6f4209b857efb3416d3152bbabb5d12bd0e0cf285ab16c3b4292ad6a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arm-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68ca3369e2fafc9c53e0e29146ebd4d60493a8765224a59c81a07a4f3af6e0b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1098 Malicious code in arm-attestation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68ca3369e2fafc9c53e0e29146ebd4d60493a8765224a59c81a07a4f3af6e0b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-2970 · Intel +9 · Sgx Psw +12

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to incomplete cleanup in specific special register write operations, which may allow an authenticated user to potentially enable information disclosure via...

Vulnerabilities Affecting Dominion Voting Systems ImageCast X

1. SUMMARY This advisory identifies vulnerabilities affecting versions of the Dominion Voting Systems Democracy Suite ImageCast X, which is an in-person voting system used to allow voters to mark their ballot. The ImageCast X can be configured to allow a voter to produce a paper record or to...

PT-2022-3368

Name of the Vulnerable Software and Affected Versions Dominion Voting Systems ImageCast X affected versions not specified Description The issue concerns the on-screen application hash display feature, audit log export, and application export functionality of Dominion Voting Systems ImageCast X,...

[SECURITY] Fedora 35 Update: keylime-6.4.0-1.fc35

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

Fedora: Security Advisory for keylime (FEDORA-2022-748fda10e7)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: keylime-6.4.0-1.fc36

Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution...

PYSEC-2022-184

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an...

CVE-2022-0317

An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the...