Authorization Bypass

github.com/kyverno/kyverno is vulnerable to authorization bypass.The vulnerability exists in multiple functions due to an image signature validation which allows an attacker to bypass the restrictions and retrieve data via the verifyImages rule...

CVE-2022-47633

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations a...

CVE-2022-23540

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

Input validation

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

CVE-2022-23540 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

CVE-2022-23540

CVE-2022-23540 affects the jsonwebtoken library. In versions

CVE-2022-23540 jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify function. This issu...

jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()

Overview In versions =8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the jwt.verify function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Am I affected? You will be affected if all the followi...

CVE-2021-4126

The CVE-2021-4126 issue affects Thunderbird: when receiving an OpenPGP/MIME signed email with an outer MIME layer (e.g., mailing list footer), Thunderbird incorrectly treated inner content as signed. The root cause is that the displayed signature status was based on the inner part; since 91.4.1, ...

PT-2022-28078 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.8.3 through 1.8.4 Description: An image signature validation bypass issue allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster...

Schneider Electric EcoStruxure Operator Terminal Expert 数据伪造问题漏洞

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software support is mainly used for creating and editing touch applications. A data forgery vulnerability exists in Schneider Electric EcoStruxure Operator Termin...

Linktree: Account takeover - improper validation of jwt signature (with regards to experiation date claim)

Some backend services did not properly validate JWTs. As a result JWT validation could be bypassed by setting the expiration date claim to a unix timestamp in the past, and abusing this for account takeover. The expiration date claim of the JWT token was not properly handled. I was able to bypass...

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

Design/Logic Flaw

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-42793

CVE-2022-42793 concerns a vulnerability where code signing validation could be bypassed due to inadequate checks. The issue affects Apple platforms and was addressed by improving code signing validation in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7, iPadOS 15.7, and macOS Monterey 12....

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789

The CVE-2022-42789 entry concerns an issue in code signature validation that could allow an app to access user-sensitive data. Apple fixed the vulnerability in macOS Big Sur 11.7, macOS Monterey 12.6, and macOS Ventura 13, addressing the problem by enforcing improved checks during code signing va...