CVE-2022-24759

In CVE-2022-24759, the @chainsafe/libp2p-noise TypeScript implementation fails to validate signatures during the handshake, enabling a potential man-in-the-middle impersonation of peers and subsequent banning. Affected versions are before 4.1.2 and 5.0.3. The documented remediation is to upgrade ...

CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

SUSE-SU-2022:0886-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Update to version 7.2.5.1 jscSLE-18214: - CVE-2021-25636: Fixed an incorrect vadidation of digitally signed documents bsc1196456...

Input validation

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

CVE-2022-23655 Missing server signature validation in OctoberCMS

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

CVE-2022-23655

CVE-2022-23655 affects Octobercms (Laravel-based) where affected versions did not validate gateway server signatures. This allows non-authoritative gateway servers to exfiltrate user private keys. The fix is available via upgrading to build 474 or v1.1.10, or applying the patch commit e3b455ad587...

CVE-2022-23655 Missing server signature validation in OctoberCMS

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

LibreOffice 信任管理问题漏洞

LibreOffice is an open source office software suite from The Document Foundation tdf. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. A trust management issue vulnerability exists in libreoffice, which stems from libreoffice: signature...

Insecure Signature Validation

Cosign is vulnerable to insecure signature verification. Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both...

Huawei HarmonyOS 数据伪造问题漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a vulnerability in the Wearables recovery upgrade system where the signature validation...

WinVerifyTrust Signature Validation Vulnerability

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the forma...

Adobe Acrobat and Reader DC 安全漏洞

Adobe Acrobat and Reader DC is the American Adobe's PDF creation program. Adobe Acrobat and Reader DC suffers from a security signature issue vulnerability that inadequately validates user-supplied input. A remote attacker could exploit this vulnerability to trick a victim into opening a speciall...

CVE-2021-20156

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if i...

Improper access control

Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if i...

CVE-2021-20156

The CVE-2021-20156 entry concerns Trendnet AC2600 TEW-827DRU (firmware version 2.08B01) with improper access control that could let an attacker install malicious firmware. The vulnerability arises from lack of signature validation for firmware updates, including those delivered via the admin inte...

Insecure Signature Validation

thunderbird:sid has insecure signature validation. When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validit...

UBUNTU-CVE-2021-4126

When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...

CVE-2021-26335

Improper input and range checking in the AMD Secure Processor ASP boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution...

Input validation

Improper input and range checking in the AMD Secure Processor ASP boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution...

PT-2021-8202 · Amd +1 · Amd Platform Security Processor +2

Name of the Vulnerable Software and Affected Versions: AMD Platform Security Processor affected versions not specified Description: The issue is related to improper input and range checking in the AMD Secure Processor ASP boot loader image header. This may allow an attacker to use...