734 matches found
CVE-2021-43569: Improper Verification of Cryptographic Signature
The verify function in the Stark Bank .NET ECDSA library ecdsa-dotnet 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
CVE-2021-43570: Improper Verification of Cryptographic Signature
The verify function in the Stark Bank Java ECDSA library ecdsa-java 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
CVE-2021-43571: Improper Verification of Cryptographic Signature
The verify function in the Stark Bank Node.js ECDSA library ecdsa-node 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...
CVE-2021-37127
There is a signature management vulnerability in some huawei products. An attacker can forge signature and bypass the signature check. During firmware update process, successful exploit this vulnerability can cause the forged system file overwrite the correct system file. Affected product version...
Huawei Imanager NetEco 数据伪造问题漏洞
Huawei Imanager NetEco is a professional energy infrastructure management platform from Huawei of China. It is used to provide accurate operations and maintenance management. Huawei iManager NetEco has a security vulnerability that could be exploited by attackers to forge signatures, bypass...
UBUNTU-CVE-2021-25633
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to...
SUSE: Security Advisory (SUSE-SU-2016:0107-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[ASA-202104-4] thunderbird: multiple issues
Arch Linux Security Advisory ASA-202104-4 ========================================= Severity: High Date : 2021-04-29 CVE-ID : CVE-2021-23961 CVE-2021-23994 CVE-2021-23995 CVE-2021-23998 CVE-2021-23999 CVE-2021-24002 CVE-2021-29946 CVE-2021-29948 Package : thunderbird Type : multiple issues Remote...
SUSE: Security Advisory (SUSE-SU-2014:1510-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-36315
In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...
CVE-2020-36315
In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...
Design/Logic Flaw
In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...
CVE-2020-36315
Summary: CVE-2020-36315 affects RELIC before 2020-08-01, allowing RSA PKCS#1 v1.5 signature forgery due to inadequate padding checks (and issues with the first two bytes). The vulnerability’s exploitation requires a low public exponent (e.g., 3), and the product defaults to not using such small e...
CVE-2020-36315: Use of a Broken or Risky Cryptographic Algorithm
In RELIC before 2020-08-01, RSA PKCS1 v1.5 signature forgery can occur because certain checks of the padding and of the first two bytes are inadequate. NOTE: this requires that a low public exponent such as 3 is being used. The product, by default, does not generate RSA keys with such a low numbe...
EulerOS 2.0 SP2 : strongimcv (EulerOS-SA-2021-1364)
According to the versions of the strongimcv package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate.CVE-2018-17540 - In verifyemsapkcs1signature in...
New SHA-1 Attack
There's a new, practical, collision attack against SHA-1: In this paper, we report the first practical implementation of this attack, and its impact on real-world security with a PGP/GnuPG impersonation attack. We managed to significantly reduce the complexity of collisions attack against SHA-1: ...
CVE-2019-9153
Improper Verification of a Cryptographic Signature in OpenPGP.js =4.1.2 allows an attacker to forge signed messages by replacing its signatures with a "standalone" or "timestamp" signature...
CVE-2019-11841
A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The...
CVE-2018-16253
In sigverify in x509.c in axTLS version 2.1.3 and before, the PKCS1 v1.5 signature verification does not properly verify the ASN.1 metadata. Consequently, a remote attacker can forge signatures when small public exponents are being used, which could lead to impersonation through fake X.509...
CVE-2018-16150
In axTLS 2.1.3 and earlier, the PKCS#1 v1.5 signature verification in sig_verify() fails to reject excess data after the hash, enabling signature forgery when small public exponents are used. This can lead to impersonation via forged X.509 certificates. This CVE-2018-16150 is a variant of CVE-200...