Digital-Signature-Forgery-Attack

在本文中，我们将探讨数字签名伪造攻击（Digital Signature Forgery Attack）的密码学原理，其后果对比特币网络中的交易安全构成威胁，因为数字签名用于确认加密货币转账的所有权和授权。我们将根据现代研究和已识别的漏洞，分析此类攻击对比特币的影响示例。 数字签名伪造攻击（Digital Signature Forgery Attack）是指攻击者试图创建一个被比特币网络视为有效的虚假 ECDSA 数字签名。这种攻击允许在不知道所有者私钥的情况下授权交易，从而危及 BTC 币持有者加密钱包中资金的安全。 教程：https://youtu.be/qbu1mC1wyA...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artefactos para la publicación USENIX | Artículo completo aquí Resumen OpenPGP y S/MIME son los dos estándares principales para cifrar y firmar digitalmente correos electrónicos. Se supone que las firmas digitales garantizan la autenticidad e integridad de los mensajes. En es...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – Falsificación de Firmas por Aleatoriedad Débil en WOTS+ de SPHINCS+ Resumen Una implementación del esquema de firmas post-cuánticas SPHINCS+ utiliza un generador de números aleatorios defectuoso durante la generación de firmas WOTS+. El mismo nonce k se reutiliza en múltiples...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1784899428)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784899428 advisory. - NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential...

CVE-2026-0265-check

CVE-2026-0265 漏洞评估工具 安全地判断 Palo Alto Networks PAN-OS GlobalProtect 门户是否易受 CVE-2026-0265 影响，无需认证任何会话或修改任何状态。 描述 CVE-2026-0265 是一个影响 PAN-OS 和 Panorama 的远程认证绕过漏洞，当认证配置文件使用云认证服务 CAS 时触发。libpanmpmp.so 中存在漏洞的 panauthverify 函数完全根据攻击者控制的 alg 头部分派 JSON Web Token 签名验证——一个伪造的 JWT，其 alg=HS256 且签名为...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where a public JWK container such as a JWK Set with a kty member nested inside a JSON array o...

CVE-2022-21449

CVE-2022-21449 repositorio que muestra la generación de una firma base64 para aplicaciones vulnerables a "firmas psíquicas en java", implementado en un entorno nodejs 😅 Antes de ejecutar, asegúrate de instalar el fork modificado de elliptic desde https://github.com/davwwwx/elliptic $ npm install...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ispemformat in jwt/utils.py, which fails to recognize certain loader-accepted PEM formatting variants as valid PEM. The fix for...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs

Summary IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-16177 DESCRIPTION: IBM DataPower Gateway could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

EUVD-2026-84946

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

PT-2026-97094

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper verification of cryptographic signatures could allow a remote attacker to forge validly-signed messages. Recommendations At the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-054045)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054045 advisory. GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME ar...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: gnupg2 (UTSA-2026-090063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090063 advisory. A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forge...

CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-42784 Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

EUVD-2026-80888

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...

CVE-2026-42784

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an...