Design/Logic Flaw

Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code MAC which is generated based on a secret key which is NULL...

CVE-2020-36285

Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code MAC which is generated based on a secret key which is NULL...

CVE-2020-36284

The CVE-2020-36284 issue affects UnionPay on Android versions prior to 3.4.93.4.9. Root cause: improper verification of cryptographic signatures (CWE-347) due to a MAC generated based on a secret key that is NULL. Impact: attackers can shop for free on merchants’ websites and mobile apps by craft...

CVE-2020-23533

CVE-2020-23533 affects Union Pay web versions up to 1.2.0 and is linked to a CWE-347 vulnerability: improper verification of a cryptographic signature. An attacker can craft an authentication code (MAC) generated from a NULL/empty key to make free purchases on merchant websites and mobile apps. C...

CVE-2020-36284: Improper Verification of Cryptographic Signature

Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code MAC which is generated based on a secret key which is NULL...

CVE-2020-36285: Improper Verification of Cryptographic Signature

Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code MAC which is generated based on a secret key which is NULL...

PT-2021-11992

Name of the Vulnerable Software and Affected Versions: Union Pay versions up to 3.3.12 Description: The issue allows attackers to shop for free in merchants' websites and mobile apps by generating a crafted authentication code MAC based on a secret key which is NULL. This is due to an improper...

PT-2021-11991

Name of the Vulnerable Software and Affected Versions: Union Pay versions up to 3.4.93.4.9 Description: The issue allows attackers to shop for free in merchants' websites and mobile apps via a crafted authentication code MAC generated based on a secret key which is NULL. This is due to an imprope...

CVE-2020-23533: Improper Verification of Cryptographic Signature

Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code MAC which is generated based on a secret key which is NULL...

CVE-2021-1376: Improper Verification of Cryptographic Signature

Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and...

Security Advisory YSA-2021-03 | Yubico

A security update for pam-u2f resolves a logic issue that, depending on the pam-u2f configuration and the application used, could lead to a local PIN bypass. This issue does not allow user presence touch or cryptographic signature verification to be bypassed, so an attacker would still need to...

Debian DLA-2577-1 : python-pysaml2 security update

Several issues have been found in python-pysaml2, a pure python implementation of SAML Version 2 Standard. CVE-2017-1000433 pysaml2 accept any password when run with python optimizations enabled. This allows attackers to log in as any user without knowing their password. CVE-2021-21239 pysaml2 ha...

PT-2021-7384 · Grub2 +2 · Grub2 +2

Name of the Vulnerable Software and Affected Versions: Grub2 versions prior to 2.06 Description: The issue is related to the implementation of the shim lock mechanism in Grub2, which is associated with incorrect cryptographic signature verification. This flaw allows an attacker to boot any kernel...

Debian: Security Advisory (DLA-2577-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-3406: Improper Verification of Cryptographic Signature

A flaw was found in keylime 5.8.1 and older. The issue in the Keylime agent and registrar code invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations...

PT-2021-7705

Name of the Vulnerable Software and Affected Versions RPM versions prior to 4.17.0-alpha Description A flaw was found in the RPM package's read functionality, allowing an attacker to cause RPM database corruption by convincing a victim to install a seemingly verifiable package or compromising an...

Design/Logic Flaw

An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized use...

CVE-2021-3033 Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console

An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized use...

Prisma Cloud Compute: SAML Authentication Bypass Vulnerability in Console

An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized use...

CVE-2021-3033: Improper Verification of Cryptographic Signature

An improper verification of cryptographic signature vulnerability exists in the Palo Alto Networks Prisma Cloud Compute console. This vulnerability enables an attacker to bypass signature validation during SAML authentication by logging in to the Prisma Cloud Compute console as any authorized use...