RHEL 7 : perl-module-signature (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - perl-Module-Signature: unsigned files interpreted as signed in some circumstances CVE-2015-3406 -...

RHEL 7 : fwupd (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - fwupd: Possible bypass in signature verification CVE-2020-10759 Note that Nessus has not tested for this issue but...

[SECURITY] Fedora 39 Update: rust-sequoia-sqv-1.2.1-2.fc39

A simple OpenPGP signature verification program...

USN-6800-1 node-browserify-sign vulnerability

It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a signature forgery attack...

USN-6800-1: browserify-sign vulnerability

It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to perform a signature forgery attack...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : browserify-sign vulnerability (USN-6800-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by a vulnerability as referenced in the USN-6800-1 advisory. It was discovered that browserify-sign incorrectly handled an upper bound check in signature verification. If a user or an automat...

Authentication Bypass

namshi/jose is vulnerable to Authentication Bypass. The vulnerability is due to an implementation error in the validation process for digital signatures using asymmetric algorithms. which allows attackers to forge tokens by exploiting the signature verification flaw...

CVE-2024-1721

Improper Verification of Cryptographic Signature vulnerability in HYPR Passwordless on Windows allows Malicious Software Update.This issue affects HYPR Passwordless: before 9.1...

Signature Verification Bypass

onelogin/php-saml is vulnerable to Signature Verification Bypass. The vulnerability is due to implicit boolean conversion of numerical values returned by opensslverify in PHP, where an error state -1 can be interpreted as a successful signature verification, which results in misinterpretation of...

HYPR 安全漏洞

HYPR is a security application from HYPR that implements Passwordless. A security vulnerability exists in HYPR Passwordless versions prior to 9.1 that stems from a cryptographic signature vulnerability in HYPR Passwordless on Windows that improperly verifies allowing malware updates...

PT-2024-6143 · Microsoft · Office Powerpoint

Name of the Vulnerable Software and Affected Versions: Microsoft PowerPoint version 16.83 Description: A library injection issue exists, allowing a specially crafted library to leverage PowerPoint's access privileges and bypass permissions. This can be triggered by a malicious application injecti...

xml-crypto Digital Signature Forgery

The vulnerability of the digital signature and encryption library for Node.js’ xml-crypto is related to improper validation of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to forge digital signatures by inserting a newly created, specially crafted signature...

CVE-2023-50228

Parallels Desktop Updater Improper Verification of Cryptographic Signature Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged...

Signature Verification Bypass

xml-crypto is vulnerable to Signature Verification Bypass. The vulnerability is due to inadequate authorization checks for signed certificates, which allows an attacker to manipulate XML documents with falsified signatures or certificates which can bypass the library's default validation mechanis...

CVE-2024-32962 XML signature verification bypass due improper verification of signature / signature spoofing

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

CVE-2024-32962

The CVE concerns the xml-crypto library (Node.js). Affected versions 4.0.0 through 6.0.0 use a default configuration that does not validate signer authorization, only the signature’s cryptographic validity against the xmldsig-core spec. This allows an attacker to re-sign an XML document and inser...

CVE-2024-32962 XML signature verification bypass due improper verification of signature / signature spoofing

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

CVE-2024-32962

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

CVE-2024-32962: Improper Verification of Cryptographic Signature

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

xml-crypto 安全漏洞

NPM xml-crypto is a digital signature and cryptography library from NPM. A security vulnerability in xml-crypto versions 4.0.0 through 6.0.0, which stems from a default configuration that does not check the authorization of the signer, allows attackers to bypass XML signature verification...