bind9: bind: SIG(0) can be used to exhaust CPU resources

A flaw was found in the bind9 package, where if a DNS server hosts a zone containing a "KEY" resource record or a DNS resolver utilizes the DNSSEC validate feature to validate a "KEY" resource record, a malicious client could exhaust the CPU resourced from the resolver by sending a stream of SIG0...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to resource exhaustion attack due to github.com/Cloudflare/cfssl ( CVE-2023-39533 )

Summary github.com/Cloudflare/cfssl is used by IBM Cloud Pak for Data. CVE-2023-39533. Vulnerability Details CVEID:CVE-2023-39533 DESCRIPTION: libp2p go-libp2p is vulnerable to a denial of service, caused by a flaw during the signature verification. By sending a specially crafted request using...

Authentication Bypass

github.com/RobotsAndPencils/go-saml is vulnerable to an Authentication Bypass. The vulnerability is due to improper configuration of the xmlsec1 tool in the go-saml library, which fails to restrict the origin of the public key used for signature verification. It allows an attacker to sign SAML...

FreeBSD-SA-24:07.nfsclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-24:07.nfsclient Security Advisory The FreeBSD Project Topic: NFS client accepts file names containing path separators Category: core Module: NFS client...

GHSA-6H53-Q94J-348W RobotsAndPencils go-saml authentication bypass vulnerability

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

RobotsAndPencils go-saml authentication bypass vulnerability

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

PT-2024-7719 · Teamviewer · Teamviewer

Name of the Vulnerable Software and Affected Versions: TeamViewer Remote Clients versions prior to 15.58.4 Description: The issue is related to improper verification of cryptographic signatures during the installation of a printer driver via the TeamViewer service.exe component. This allows an...

ISC BIND 安全漏洞

ISC BIND is an ISC open source suite of open source software that implements the DNS protocol. A security vulnerability exists in ISC BIND 9 that stems from SIG0 can be used to exhaust CPU resources...

The vulnerability of the Palo Alto Networks Cortex XDR Agent, a tool for network traffic analysis, network detection, and response, arises from improper verification of the cryptographic signature. This allows attackers to circumvent existing security restrictions and execute arbitrary code.

The vulnerability of the Palo Alto Networks Cortex XDR Agent, which is used for network traffic analysis, network detection, and response, stems from incorrect verification of the cryptographic signature. Exploiting this vulnerability allows attackers to bypass existing security restrictions and...

The vulnerability of the Windows Enroll Engine component in Windows operating systems allows a hacker to bypass security restrictions.

The vulnerability of the Windows Enroll Engine component in Windows operating systems is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a perpetrator to circumvent security restrictions...

PT-2024-33290

Name of the Vulnerable Software and Affected Versions Elliptic package versions prior to 6.5.6 Description The issue concerns the Elliptic package for Node.js, specifically the EDDSA implementation. It does not perform the required check if the signature proofs is within the bounds of the order n...

PT-2024-4784 · Microsoft · Windows Enroll Engine +1

Name of the Vulnerable Software and Affected Versions: Windows Enroll Engine affected versions not specified Description: The issue is related to errors in cryptographic signature verification in the Windows Enroll Engine component of Windows operating systems. This allows an attacker to bypass...

PT-2024-28636 · Unknown · Electron-Updater

Name of the Vulnerable Software and Affected Versions: electron-updater versions prior to 6.3.0-alpha.6 Description: The issue concerns the signature validation routine for Electron applications on Windows, implemented in the file...

org.bouncycastle:bcprov-jdk18on: Infinite loop in ED25519 verification in the ScalarUtil class

A flaw was found in the Bouncy Castle Java Cryptography APIs. Affected versions of this package are vulnerable to an Infinite loop issue in ED25519 verification in the ScalarUtil class. This flaw allows an attacker to send a malicious signature and public key to trigger a denial of service...

CVE-2024-20892

Improper verification of signature in FilterProvider prior to SMR Jul-2024 Release 1 allows local attackers to execute privileged behaviors. User interaction is required for triggering this vulnerability...

PT-2024-18805 · Unknown · Filterprovider

Name of the Vulnerable Software and Affected Versions: FilterProvider versions prior to SMR Jul-2024 Release 1 Description: The issue is related to improper verification of signature in FilterProvider, allowing local attackers to execute privileged behaviors. User interaction is required for...

The vulnerability of the createinstallmedia component in the Parallels Desktop hypervisor allows a malicious user to elevate their privileges to the root level.

The vulnerability of the createinstallmedia component in Parallels Desktop Hypervisor Edition is related to the lack of signature verification. Exploiting this vulnerability can allow an attacker to elevate their privileges to root level using the repackosxinstallapp.sh script...

The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems allows a hacker to increase their privileges.

The vulnerability of the RPM package manager RPM in Red Hat Enterprise Linux operating systems stems from the lack of checks for verifying the signature of the dependencies before they are imported. Exploiting this vulnerability can allow an attacker to increase their privileges...

GitHub: SAML Signature verification bypass allows logging into any user (with specific conditions)

The vulnerability allowed an attacker with direct network access to GitHub Enterprise Server to forge a SAML response and gain unauthorized access to the instance, including site administrator privileges, by exploiting a signature verification bypass. The vulnerability affected all versions of...

Conduit Security Vulnerabilities

Conduit is a simple, fast and reliable chat server from the individual developer Timo Kösters. A security vulnerability exists in Conduit versions prior to v0.8.0, which stems from a key expiration that is not taken into account when verifying signatures, which could lead to an attacker using the...