1101 matches found
CVE-2017-12874
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12874
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12874
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
CVE-2017-12874
The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities...
cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted
It was found that a flaw exists in JAX-RS clients using the streaming approach for XML signatures and encryption, where it does not enforce the message to be signed/encrypted. This could allow an attacker to subvert the integrity of the message...
Input validation
The OnePlus 2 Primary Bootloader PBL does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation...
CVE-2017-11105
The OnePlus 2 Primary Bootloader PBL does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation...
CVE-2017-11105
The OnePlus 2 Primary Bootloader PBL does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation...
CVE-2017-11105
The CVE-2017-11105 vulnerability affects the OnePlus 2 Primary Bootloader (PBL). The PBL does not validate the SBL1 partition before executing it, even though the partition contains a certificate. This allows an attacker with write access to the SBL1 partition to disable signature validation. The...
Input validation
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...
CVE-2017-9457
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...
CVE-2017-9457
The CVE-2017-9457 issue affects CompuLab Intense PC (Phoenix SecureCore) UEFI firmware. The root cause is missing capsule signature verification during firmware upgrades, enabling an attacker with administrator privileges to flash a modified UEFI BIOS. CNVD-2017-26600 specifies vulnerability in f...
CVE-2017-9457
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...
Missing Message Validation
fedmsg is missing message validation. The library contains a bug where the base class' default value does not enable signature validation...
Missing Certificate Request Signature Validation
crypto/x509 in github.com/golang/go is missing certificate request signature validation. The library does not check the binding of the private key i.e., signature validation to its corresponding entities' certificate...
Response Wrapping Attacks
Python3-saml is vulnerable to response wrapping attacks. These attacks are possible in environments supporting EncryptedAssertion. The signature validation didn't verify the the number of locations and signed elements matched the expected numbers...
DEBIAN-CVE-2016-9122
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the...
PT-2017-9959 · Go · Go-Jose
Name of the Vulnerable Software and Affected Versions: go-jose versions prior to 1.1.0 go-jose versions prior to 1.0.4 Description: The go-jose library is affected by an issue related to multiple signatures exploitation. When validating a signed message, the API does not indicate which signature ...
Nextcloud: Update php-saml library to 2.10.5
The php-saml library as used by our SSO implementation had a minor security patch in 2.10.4 as per https://github.com/onelogin/php-saml/commit/949359f5cad5e1d085c4e5447d9aa8f49a6e82a1. So we should update this in our next minor releases. Security update for signature validation on...
DEBIAN-CVE-2016-9814
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attackers to spoof SAML responses or possibly cause a denial of service memory consumption by leveraging...