CVE-2018-3683

Intel Quartus Prime (versions 15.1–18.0) is affected by CVE-2018-3683 due to unquoted service paths in the JTAG server executable, allowing a local attacker to potentially execute arbitrary code with elevated privileges. The Intel advisory INTEL-SA-00151 lists affected products and recommends app...

CVE-2018-3688

CVE-2018-3688 refers to an unquoted service path vulnerability in Intel Quartus Prime Programmer and Tools, affecting Quartus Prime Programmer and Tools v15.1–18.0. The underlying issue enables a local attacker to potentially execute arbitrary code with elevated privileges by abusing the service ...

PT-2018-16125

Name of the Vulnerable Software and Affected Versions Intel Quartus Prime Programmer and Tools versions 15.1 through 18.0 Description The issue allows a local attacker to potentially execute arbitrary code due to unquoted service paths in the affected software. Recommendations For versions 15.1...

PT-2018-16122

Name of the Vulnerable Software and Affected Versions Intel Quartus Prime versions 15.1 through 18.0 Description The issue allows a local attacker to potentially execute arbitrary code due to unquoted service paths in Intel Quartus Prime. Recommendations For Intel Quartus Prime versions 15.1...

CVE-2018-3683: Unquoted Search Path or Element

Unquoted service paths in Intel Quartus Prime in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code...

CVE-2018-3688: Unquoted Search Path or Element

Unquoted service paths in Intel Quartus Prime Programmer and Tools in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code...

Intel® Quartus® Prime Pro

This advisory contains CVEs in Altera products and has been transferred to Altera for support. The updated advisory can be found at the link below: https://www.altera.com/product-security/advisory-archive/intel-sa-00157.html...

openSUSE: Security Advisory for openssl (openSUSE-SU-2018:1906-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Validation Bypass

prime-jwt is vulnerable to validation bypasses. The library allows the decoding of non-signed JWT signatures, which allows a malicious user to pass a JWT signature with a valid header using the none algorithm and bypass validation...

Ubuntu: Security Advisory (USN-3692-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSL vulnerabilities (USN-3692-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3692-1 advisory. Keegan Ryan discovered that OpenSSL incorrectly handled ECDSA key generation. An attacker could possibly use this issue to perfor...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

Design/Logic Flaw

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

CVE-2018-1000531

The vulnerability CVE-2018-1000531 affects inversoft prime-jwt prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba, where JWTDecoder.decode can mishandle signature verification (CWE-20). An attacker can craft a JWT with a valid header using the none algorithm and a body that passes validatio...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

CVE-2018-1000531

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...

USN-3692-2: OpenSSL vulnerabilities

USN-3692-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that OpenSSL incorrectly handled ECDSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and...

PT-2018-9428

Name of the Vulnerable Software and Affected Versions inversoft prime-jwt versions prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba Description The issue concerns an incorrect signature validation of a JWT token. An attacker can exploit this by crafting a JWT token with a valid header usi...

CVE-2018-1000531: Improper Input Validation

inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an incorrect signature validation of a JWT token. This attack can be exploitable when an attacker crafts a JWT token with a valid header usi...