The _verifySignature function skips signature verification if the offerer is the caller.

Lines of code Vulnerability details Impact it could have a significant impact on the security of the smart contract. The function is intended to verify the signature of an order, but if the offerer is the caller, the function skips the signature verification. This could allow someone other than t...

Unauthorized Access in _verifySignature function due to improper use of msg.sender.

Lines of code Vulnerability details Impact if unmaskedAddressComparisonofferer, msg.sender return; If an attacker is able to call this function and make the msg.sender match the offerer, they will bypass the signature verification check and may be able to execute the contract's functionality as i...

Lack of owner verification in EIP-1271 signature check

Lines of code Vulnerability details Description In the checkSignatures there are checks that the signer is the account owner, but in the case of EIP-1271 signature check there are no such checks: // If v is 0 then it is a contract signature // When handling contract signatures the address of the...

CVE-2022-23539

A flaw was found in the jsonwebtoken package. The affected versions of the jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm...

Signature Validation Bypass

jsonwebtoken is vulnerable to signature validation bypass. The lack of algorithm definition in the jwt.verify function leads to signature validation bypass due to defaulting to the none algorithm for signature verification, which allows an attacker to bypass the verification mechanism...

jsonwebtoken 加密问题漏洞

jsonwebtoken is a JSON Web token implementation from Auth0 Open Source. A cryptographic issue vulnerability exists in jsonwebtoken version 8.5.1 and prior versions, which stems from old, insecure key types used for signature verification...

CVE-2022-23539

CVE-2022-23539 affects jsonwebtoken versions ≤ 8.5.1, where misconfiguration could allow legacy insecure key types to be used for signature verification (e.g., DSA with RS256). The issue has been fixed in v9.0.0, which validates asymmetric key type/algorithm combinations. After upgrading, if you ...

CVE-2022-23539 jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...

CVE-2022-23539 jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...

DEBIAN-CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

jsonwebtoken 数据伪造问题漏洞

jsonwebtoken is Auth0 open source implementation of a JSON Web token . jsonwebtoken version 8.5.1 and earlier versions of data forgery vulnerability , the vulnerability stems from the default use of the "none" algorithm for signature verification , jwt.verify function in the lack of algorithm...

PT-2022-16059

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The jsonwebtoken library could be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm. Users are affected if they use...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

Design/Logic Flaw

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

OP-TEE Trusted OS 数据伪造问题漏洞

OP-TEE Trusted OS is an OP-TEE open source Trusted Execution Environment TEE that implements Arm TrustZone technology. A security vulnerability exists in OP-TEE Trusted OS versions prior to 3.20, which stems from an unprotected memory access operation in opteeos that allows a physically proximate...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

CVE-2022-47549

The vulnerability CVE-2022-47549 affects OP-TEE within TrustedFirmware (OP-TEE) prior to version 3.20. The root cause is an unprotected memory-access operation in optee_os that enables a physically proximate attacker to bypass signature verification and install malicious trusted applications thro...

Zoom Client for Meetings < 5.5.4 Vulnerability (ZSB-21016)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.5.4. It is, therefore, affected by a vulnerability as referenced in the ZSB-21016 advisory. - The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files...