Improper Verification Of Cryptographic Signature

openpgp.js is performs improper verification of cryptographic signature. The vulnerability exists as openpgp.js incorrectly trusts unhashed signature subpackets...

Digital Signature Bypass

openpgp.js is vulnerable to digital signature bypass. The vulnerability exists through an improper verification of a cryptographic signature which allows adversaries to replace signatures with a standalone or timestamp signature...

Medium: ruby

Issue Overview: It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory...

CVE-2019-9154

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

Input validation

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

Input validation

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9154

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-9154

OpenPGP.js vulnerable versions:

CVE-2019-9153

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

CVE-2019-9153: Improper Verification of Cryptographic Signature

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...

CVE-2019-9154: Improper Verification of Cryptographic Signature

Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to pass off unsigned data as signed...

CVE-2019-2278: Improper Verification of Cryptographic Signature

User keystore signature is ignored in boot and can lead to bypass boot image signature verification in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in MDM9607, MDM9640, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SDM660...

SAML Authentication Bypass

samlr is vulnerable to authentication bypass attacks. This is due to inconsistent validation of signed assertions which allows an attacker to manipulate SAML data without invalidating the cryptographic signature and bypass authentication to SAML service providers...

CVE-2019-1010263: Improper Verification of Cryptographic Signature

Perl Crypt::JWT prior to 0.023 is affected by: Incorrect Access Control. The impact is: allow attackers to bypass authentication by providing a token by crafting with hmac. The component is: JWT.pm, line 614. The attack vector is: network connectivity. The fixed version is: after commit...

CVE-2019-9149: Improper Verification of Cryptographic Signature

Mailvelope prior to 3.3.0 allows private key operations without user interaction via its client-API. By modifying an URL parameter in Mailvelope, an attacker is able to sign and encrypt arbitrary messages with Mailvelope, assuming the private key password is cached. A second vulnerability allows ...

GHSA-94HM-8Q65-RMXM OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass...

GHSA-X2FR-V8WF-8WWV Ruby-SAML Improper Authentication vulnerability

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...

Ruby-SAML Improper Authentication vulnerability

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication...