Improper Verification of Cryptographic Signature in node-forge

Impact RSA PKCS1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. Patches The issue has been...

CVE-2022-24773 Improper Verification of Cryptographic Signature in `node-forge`

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that...

CVE-2022-24771 Improper Verification of Cryptographic Signature in node-forge

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses...

CVE-2022-23610 Improper Verification of Cryptographic Signature in wire-server

wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was...

CVE-2022-23610 Improper Verification of Cryptographic Signature in wire-server

wire-server provides back end services for Wire, an open source messenger. In versions of wire-server prior to the 2022-01-27 release, it was possible to craft DSA Signatures to bypass SAML SSO and impersonate any Wire user with SAML credentials. In teams with SAML, but without SCIM, it was...

The vulnerability of the CMS system October CMS, related to improper verification of the cryptographic signature, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the CMS system October CMS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Improper Verification Of Signature

libreoffice:sid is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to contain both X509Data and KeyValue children of the KeyInfo tag. When opened, it causes LibreOffice t...

Rocky Linux 8 : lasso (RLSA-2021:4325)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4325 advisory. - Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. CVE-2021-28091 Note that Nessus has not tested for this issue but has...

Siemens S7-400 CPUs Improper Verification of Cryptographic Signature (CVE-2018-16557)

A vulnerability has been identified in SIMATIC S7-400 incl. F V6 and below All versions, SIMATIC S7-400 PN/DP V7 incl. F All versions, SIMATIC S7-400H V4.5 and below All versions, SIMATIC S7-400H V6 All versions V6.0.9, SIMATIC S7-410 All versions V8.2.1. Sending of specially crafted packets to...

Reolink RLC-410W "update" firmware checks firmware update vulnerability

Summary A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability. Tested Versions Reolink...

Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature.

...

The vulnerability of the dnf module in the Ansible configuration management system arises from incorrect verification of the cryptographic signature of data. This allows a perpetrator to compromise the integrity of the data and also cause service failures.

The vulnerability of the dnf module in the Ansible configuration management system is related to incorrect verification of the cryptographic signature of data. Exploiting this vulnerability can allow an attacker to compromise the integrity of data and also cause service failures...

CVE-2021-0152

Improper verification of cryptographic signature in the installer for some IntelR Wireless BluetoothR and KillerTM BluetoothR products in Windows 10 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2021-0152

CVE-2021-0152 affects Intel® Wireless Bluetooth® and Killer™ Bluetooth® installer on Windows 10. The Red Hat/NVD entries and Intel advisory confirm the root cause: improper verification of the cryptographic signature in the installer, enabling a local, authenticated user to potentially cause a de...

CVE-2021-0152

Improper verification of cryptographic signature in the installer for some IntelR Wireless BluetoothR and KillerTM BluetoothR products in Windows 10 may allow an authenticated user to potentially enable denial of service via local access...

Oracle Linux 8 : lasso (ELSA-2021-4325)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-4325 advisory. - Resolves: rhbz1951653 - CVE-2021-28091 lasso: XML signature wrapping vulnerability when parsing SAML responses rhel-8 - Resolves: rhbz1951653 - CVE-2021-28091...

The vulnerability of the Apache OpenOffice office software, related to errors in checking the cryptographic signature, allows a perpetrator to manipulate signed documents.

The vulnerability of the Apache OpenOffice office software is related to errors during the verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to manipulate signed documents remotely...

Intel Wireless Bluetooth Denial of Service Vulnerability

Intel Wireless Bluetooth is a driver tool from the United States Intel Intel that can effectively solve some problems with intel Bluetooth in Win10. Intel Wireless Bluetooth has a denial of service vulnerability that stems from some Intel Wireless Bluetooth and Killer Bluetooth products incorrect...

Improper Verification of Cryptographic Signature in starkbank-ecdsa

The verify function in the Stark Bank Java ECDSA library ecdsa-java 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

GHSA-92VM-MXJF-JQF3 Improper Verification of Cryptographic Signature in starkbank-ecdsa

The verify function in the Stark Bank Python ECDSA library starkbank-ecdsa 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...