CVE-2022-34763

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V2.01 and later, OPC UA Modicon...

CVE-2022-34763

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V2.01 and later, OPC UA Modicon...

The vulnerability of the RSA BSAFE Micro Edition Suite and BSAFE Crypto-C Micro Edition security tools lies in their improper verification of cryptographic signatures. This allows a malicious actor to execute arbitrary code in the context of the current user.

The vulnerability of the RSA BSAFE Micro Edition Suite and BSAFE Crypto-C Micro Edition security tools is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context of the current user...

The vulnerability of the IDToken verifier in the client-side Java OAuth library allows a perpetrator to load arbitrary files.

The vulnerability of the IDToken verifier in the client Java OAuth library is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to download arbitrary files remotely...

PT-2022-3586 · Dell +1 · Dell Bsafe Crypto-C Micro Edition +2

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.5.2 Description: The issue is related to improper input validation, which can allow a remote attacker to execute arbitrary code in th...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

openSUSE: Security Advisory for openssl-3 (SUSE-SU-2022:2306-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2306-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2022-2068: Fixed more shell code injection issues in crehash. bsc1200550 - CVE-2022-1292: Properly sanitise shell metacharacters in crehash script. bsc1199166 - CVE-2022-1343: Fixed incorrect signature verification in OCSPbasicverify...

Insecure Signature Verification

jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...

The vulnerability relates to the signature verification function of Authenticode for the Windows operating system, allowing a perpetrator to execute arbitrary code.

The vulnerability of the Authenticode signature verification function in the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Qualcomm 芯片数据伪造问题漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits including primarily semiconductor devices, but also passive components, etc., and from time to time are manufactured on the surface of semiconductor wafers. A data forgery issue vulnerability exists in multipl...

Qualcomm 芯片数据伪造问题漏洞

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits including primarily semiconductor devices, but also passive components, etc., and from time to time are manufactured on the surface of semiconductor wafers. A data forgery problem vulnerability exists in sever...

ecdsa-elixir fails to check signatures, vulnerable to message forging

Summary Stark Bank is a financial technology company that provides services to simplify and automate digital banking, by providing APIs to perform operations such as payments and transfers. In addition, Stark Bank maintains a number of cryptographic libraries to perform cryptographic signing and...

Magento observable timing discrepancy vulnerability

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

GHSA-XGP9-J48H-JJF9 Magento observable timing discrepancy vulnerability

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

Magento Signature verification bypass

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

GHSA-J2R4-2CR6-H3R3 Magento Signature verification bypass

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

GHSA-R6J5-FQX9-7QV9 Mattermost Server SAML implementation does not require encryption or signature verification as default

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...

Mattermost Server SAML implementation does not require encryption or signature verification as default

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory...

PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens...