GHSA-2XP3-57P7-QF4V xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing

Summary Default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of https://www.w3.org/TR/2008/REC-xmldsig-core-20080610/sec-CoreValidation. As such, without additional validation steps, the default configuration allows a...

SUSE-SU-2024:1462-1 Security update for shim

This update for shim fixes the following issues: - Update shim-install to set the TPM2 SRK algorithm bsc1213945 - Limit the requirement of fde-tpm-helper-macros to the distro with suseversion 1600 and above bsc1219460 Update to version 15.8: Security issues fixed: - mok: fix LogError invocation...

PT-2024-6165 · Microsoft · Office Onenote

Name of the Vulnerable Software and Affected Versions: Microsoft OneNote version 16.83 Description: A library injection vulnerability exists in Microsoft OneNote for macOS. This issue is related to incorrect cryptographic signature verification, allowing a specially crafted library to leverage...

PT-2024-6166 · Microsoft · Office Word

Name of the Vulnerable Software and Affected Versions: Microsoft Word version 16.83 for macOS Description: A library injection vulnerability exists in Microsoft Word. A specially crafted library can leverage Word's access privileges, potentially leading to a permission bypass. A malicious...

Secure Boot Bypass

The vulnerability in the implementation of the Secure Boot protocol for Windows operating systems is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a perpetrator to circumvent security restrictions...

PT-2024-6168

Name of the Vulnerable Software and Affected Versions Microsoft Teams versions 24046.2813.2770.1094 Description A library injection vulnerability exists in Microsoft Teams for macOS. This issue allows a specially crafted library to leverage Teams's access privileges, leading to a permission bypas...

ROS-20240410-21

A vulnerability in the RPM Package Manager of Red Hat Enterprise Linux operating systems is related to the lack of RPM signature verification of subsection binding before importing them. Exploitation exploitation of the vulnerability could allow an attacker to escalate his privileges A...

GHSA-HW42-3568-WJ87 google-oauth-java-client improperly verifies cryptographic signature

Summary The vulnerability impacts only users of the IdTokenVerifier class. The verify method in IdTokenVerifier does not validate the signature before verifying the claims e.g., iss, aud, etc.. Signature verification makes sure that the token's payload comes from valid provider, not from someone...

PT-2024-2789

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to an incorrect verification of cryptographic signatures in the implementation of the Secure Boot protocol for Windows operating systems. This could allow an attacker to...

Grafana Improper Cryptographic Signature

The vulnerability of the Grafana monitoring and observation platform relates to bypassing the plugin signature verification process. Exploiting this vulnerability allows a malicious actor to install malware on a vulnerable device remotely...

PT-2024-2653

Name of the Vulnerable Software and Affected Versions osbuild-composer affected versions not specified Description A flaw in osbuild-composer can trigger a condition that disables GPG verification for package repositories. This can expose the build phase to a Man-in-the-Middle attack, allowing...

Veritas NetBackup IT Analytics Cryptographic Signature Error

The vulnerability of Veritas NetBackup IT Analytics data analysis software is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the data...

openSUSE 15: google-oauth-java-client / google-oauth-java-client-java6 / etc (SUSE-SU-2024:0806-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:0806-1 advisory. - CVE-2021-22573: Fixed token signature not verified bsc1199188. Tenable has extracted the preceding description block directly from the SUSE security...

SUSE-SU-2024:0806-1 Security update for google-oauth-java-client

This update for google-oauth-java-client fixes the following issues: - CVE-2021-22573: Fixed token signature not verified bsc1199188...

CVE-2023-48703

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

Authentication flaw

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

CVE-2023-48703 SAML authentication bypass vulnerability in RobotsAndPencils/go-saml

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

CVE-2023-48703 SAML authentication bypass vulnerability in RobotsAndPencils/go-saml

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

BIT-MAGENTO-2020-9588

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

BIT-MAGENTO-2020-9690

Magento versions 2.3.5 and earlier, and 2.3.5 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...