Digitally Signed Bandook Trojan Reemerges in Global Spy Campaign

A wave of targeted cyberattack campaigns bent on espionage is cresting around the globe, using a strain of a 13-year old backdoor trojan named Bandook. According to Check Point Research, Bandook was last spotted being used in 2015 and 2017/2018, in the “Operation Manul” and “Dark Caracal”...

Barco wePresent WiPG-1600W Insecure Firmware Image Vulnerability

Barco wePresent WiPG-1600W versions 2.5.1.8, 2.5.0.25, 2.5.0.24, and 2.4.1.19 have firmware that does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modified/malicious images. Title: Barco wePresent Insecure Firmware Image Publication...

GovRAT 2.0 - FUD unknown RAT with special functions

This RAT was written by me and cannot be blocked. FUD tested with the strictest firewall policies. You are buying the source code + digital certificate to sign your files. I can also host the C&C for you for extra Functions: Access C&C with any browser. Compile C&C for Linux OR Windows. VALID...

Validation Bypass

xml-crypto is vulnerable to validation bypass. The vulnerability exists through a possible key confusion by injecting a valid HMAC-SHA1 signature, as both HMAC and the public key digital signature methods key shares the same variable...

CVE-2020-13101

In OASIS Digital Signature Services DSS 1.0, an attacker can control the validation outcome i.e., trigger either a valid or invalid outcome for a valid or invalid signature via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation...

CVE-2020-13101

CVE-2020-13101 affects OASIS Digital Signature Services (DSS) 1.0. The issue allows an attacker to control the validation outcome (valid/invalid) of a signature by crafting an XML signature when the InlineXML option is enabled, defeating non‑repudiation. The connected PT-2020-13334 entry confirms...

CVE-2020-13101

In OASIS Digital Signature Services DSS 1.0, an attacker can control the validation outcome i.e., trigger either a valid or invalid outcome for a valid or invalid signature via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation...

PT-2020-13334 · Oasis · Oasis Digital Signature Services

Name of the Vulnerable Software and Affected Versions: OASIS Digital Signature Services DSS version 1.0 Description: The issue allows an attacker to control the validation outcome of a signature via a crafted XML signature when the InlineXML option is used, defeating the expectation of...

The vulnerability of the NSS libraries, which rely on the use of the ECDSA (Elliptic Curve Digital Signature Algorithm) cryptographic algorithm, contains flaws that allow attackers to gain unauthorized access to protected information.

The vulnerability of the NSS libraries is related to the use of the ECDSA Elliptic Curve Digital Signature Algorithm cryptographic algorithm, which has vulnerabilities. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

UBUNTU-CVE-2020-12401

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox 80 and Firefox for Android 80...

Digital Signature Hijack - Binaries, PowerShell Scripts And Information About Digital Signature Hijacking

Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a PowerShell script based on...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

Huawei Data Communication: Digital Signature Verification Bypass Vulnerability in Some Huawei AR Products (huawei-sa-20190320-01-ar)

There is a digital signature verification bypass vulnerability in some Huawei AR products. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later...

MS16-004: Description of the security update for Visio 2013: January 12, 2016

MS16-004: Description of the security update for Visio 2013: January 12, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Microsoft Office file. To learn more about these vulnerabilities, see...

Denial Of Service (DoS)

openjdk is vulnerable to denial of service. A flaw was found in the XML Digital Signature component in OpenJDK. Untrusted code could use this flaw to replace the Java Runtime Environment JRE XML Digital Signature Transform or C14N algorithm implementations to intercept digital signature operation...

Authentication Bypass

java is vulnerable to authentication bypass. A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or...

Security Bulletin: OpenSSLにある複数の脆弱性のWebSphere Message BrokerとIBM Integration Busへの影響について

Summary OpenSSLの脆弱性について、OpenSSL Projectより2016年 9月22日、9月26日、11月10日にそれぞれ公表されております。WebSphere Message BrokerならびにIBM Integration Busにて使用されているDataDirect ODBC ドライバーに対して該当するCVEがあり、対処しております。 Vulnerability Details 最新の情報は下記の文書（英語）をご参照ください。 Security Bulletin: Multiple vulnerabilities in OpenSSL affect...

Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability that could result in the loading of unsigned firmware on boot. An authenticated attacker could exploit this flaw to load malicious firmware onto the device. cisco-sa-20190925-iosxe-digsig-bypass TRUSTED...