CVE-2021-33840

The server in Luca through 1.1.14 allows remote attackers to cause a denial of service insertion of many fake records related to COVID-19 because Phone Number data lacks a digital signature...

CVE-2021-33840

The CVE-2021-33840 issue affects Luca app up to v1.1.14, where Phone Number data is stored without a digital signature. This enables remote attackers to insert many fake COVID-19 records, causing a denial of service. Public documents confirm the vulnerability, its impact (DoS from mass fake recor...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2021-1774)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification CURLOPTSSLVERIFYPEER, also disables the...

nettle: Out of bounds memory access in signature verification

A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an...

nettle: Out of bounds memory access in signature verification

A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an...

GO-2020-0046 Panic due to malformed XML digital signature in github.com/russellhaering/goxmldsig

Due to a nil pointer dereference, a malformed XML Digital Signature can cause a panic during validation. If user supplied signatures are being validated, this may be used as a denial of service vector...

GO-2021-0060 Authentication bypass in github.com/russellhaering/gosaml2

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

GO-2020-0050 XML digital signature validation bypass in github.com/russellhaering/goxmldsig

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

GO-2021-0056

Due to the behavior of encoding/xml, a crafted XML document may cause XML Digital Signature validation to be entirely bypassed, causing an unsigned document to appear signed...

PT-2021-12657 · Goxmldsig +1 · Goxmldsig +1

Name of the Vulnerable Software and Affected Versions: gosaml2 versions prior to 0.7.0 goxmldsig versions prior to 1.1.1 Description: The issue is caused by a nil-pointer dereference when validating malformed XML Digital Signatures, leading to a crash or panic. This can be used as a denial of...

Cisco Cisco Catalyst 9000 数据伪造问题漏洞

The Cisco Catalyst 9000 is a switch from Cisco USA. A security vulnerability exists in the Cisco Catalyst 9000 Family that originates from an improper check in the code function that manages the digital signature verification of the system image file during the initial boot process. An attacker...

CVE-2021-21387

Wrongthink peer-to-peer, end-to-end encrypted messenger with PeerJS and Axolotl ratchet. In wrongthink from version 2.0.0 and before 2.3.0 there was a set of vulnerabilities causing inadequate encryption strength. Part of the secret identity key was disclosed by the fingerprint used for connectio...

Newest Intel Side-Channel Attack Sniffs Out Sensitive Data

Intel processors are vulnerable to a new side-channel attack, which researchers said can allow attackers to steal sensitive information such as encryption keys or passwords. Unlike previous side-channel attacks, this attack does not rely on sharing memory, cache sets and other former tactics...

Shadow Attacks Let Attackers Replace Content in Digitally Signed PDFs

Researchers have demonstrated a novel class of attacks that could allow a bad actor to potentially circumvent existing countermeasures and break the integrity protection of digitally signed PDF documents. Called "Shadow attacks" by academics from Ruhr-University Bochum, the technique uses the...

Design/Logic Flaw

SAP HANA Database, versions - 1.0, 2.0, accepts SAML tokens with MD5 digest, an attacker who manages to obtain an MD5-digest signed SAML Assertion issued for an SAP HANA instance might be able to tamper with it and alter it in a way that the digest continues to be the same and without invalidatin...

Gaming Software Supply-Chain Attack Installs Spyware

Researchers allege, attackers have compromised the update mechanism of NoxPlayer, which is software that allows gamers to run Android apps on their PCs or Macs. They then installed malware onto victims’ devices with surveillance-related capabilities. NoxPlayer is developed by BigNox, which is a...

Software Supply-Chain Attack Hits Vietnam Government Certification Authority

Cybersecurity researchers today disclosed a new supply-chain attack targeting the Vietnam Government Certification Authority VGCA that compromised the agency's digital signature toolkit to install a backdoor on victim systems. Uncovered by Slovak internet security company ESET early this month, t...

PT-2020-16808 · Google +6 · Go +6

Name of the Vulnerable Software and Affected Versions: crewjam/saml affected versions not specified Description: A signature verification issue exists, allowing an attacker to bypass SAML Authentication, posing a threat to confidentiality, integrity, and system availability. This issue can be...

PT-2020-17180 · Go +1 · Gosaml2 +2

Name of the Vulnerable Software and Affected Versions: encoding/xml package in Go all versions Description: The issue allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications. This can cause XML Digital Signature...

S/MIME Message Takeover

thunderbird is vulnerable to S/MIME Message Takeover Attacks. A malicious S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature despite the signer having no access to the contents of the encrypted message...