535 matches found
📄 Cosign 3.0.4 Certificate Chain Validation Bypass
A logic flaw in the certificate verification process of Cosign versions 3.0.4 and below allows signatures to be accepted even when the issuing Intermediate Certificate Authority CA has already expired. This proof of concept generates a chain that can be tested with this software in order to prove...
GO-2026-4529 Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigstore/cosign...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper validation of certificate chains during signature verification when transparency log verification is skipped. An attacker can cause acceptance of signatures with expired intermediate...
GHSA-WFQV-66VQ-46RM Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
Summary When verifying artifact signatures using a certificate, Cosign first verifies the certificate chain using the leaf certificate's "not before" timestamp and later checks expiry of the leaf certificate using either a signed timestamp provided by the Rekor transparency log or from a timestam...
GHSA-X5M4-43JF-HH65 soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
Impact Incorrect rounding direction for signed mul and div operations The mulDivx, y, z function incorrectly handled cases where both the intermediate product $x y$ and the divisor $z$ were negative. The logic assumed that if the intermediate product was negative, the final result must also be...
CVE-2021-47898
Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMPUDSA service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in intermediate directories to gain elevated system access...
MiracleLinux 4 : nspr-4.10.2-1.AXS4, nss-3.15.3-6.0.1.AXS4, nss-util-3.15.3-1.AXS4 (AXSA:2014-054:01)
The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-054:01 advisory. nss: Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server...
Static Detection of Core Structures in Tigress Virtualization-Based Obfuscation Using an LLVM Pass
Malware often uses obfuscation to hinder security analysis. Among these techniques, virtualization-based obfuscation is particularly strong because it protects programs by translating original instructions into attacker-defined virtual machine VM bytecode, producing long and complex code that is...
CVE-2025-25176
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform...
CVE-2025-25176 GPU DDK - GPU Register value contents leaked from secure workloads to non-secure world
Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in the non-secure environment of a platform...
RulePilot: An LLM-Powered Agent for Security Rule Generation
The real-time demand for system security leads to the detection rules becoming an integral part of the intrusion detection life-cycle. Rule-based detection often identifies malicious logs based on the predefined grammar logic, requiring experts with deep domain knowledge for rule generation...
EUVD-2025-104479
Malicious code in intermediateminkz3n npm...
EUVD-2025-104478
Malicious code in intermediateratz3n npm...
MAL-2025-120825 Malicious code in intermediate_rat_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46753183cc17b505b57a1eea5e3cfbef4265da9b1a29c3065ca89e7477152e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-74518
Malicious code in intermediatecanidaeblue-28 npm...
EUVD-2025-78969
Malicious code in intermediatemarmotz3n npm...
EUVD-2025-81505
Malicious code in intermediatemuskox0xrequest npm...