PT-2023-21972 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector for Linux versions prior to 1.3.1.6 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux, which allows Code Injection...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Tor vulnerabilities (USN-5036-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5036-1 advisory. It was discovered that Tor incorrectly handled certain memory operations. A remote attacker could use this issue to cause a denia...

Acronis Agent Cryptographic Signature Verification Privilege Escalation

The vulnerability of backup and data recovery software on computers and servers with Acronis Agent, as well as Acronis CyberProtect 15 data protection software, is related to errors in verifying the cryptographic signature. Exploiting this vulnerability can allow attackers to increase their...

CVE-2023-41325 OP-TEE double free in shdr_verify_signature

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.20 and prior to version 3.22, shdrverifysignature can make a double free. shdrverifysignature used to verify a TA...

Ubuntu: Security Advisory (USN-6365-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6365-1 open-vm-tools vulnerability

It was discovered that Open VM Tools incorrectly handled SAML tokens. A remote attacker could possibly use this issue to bypass SAML token signature verification and perform VMware Tools Guest Operations...

PT-2023-5184 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the QMS.Mobile module of QMS Automotive, which uses a weak and outdated application signing mechanism. This could allow an attacker to tamper with the...

LibSSH Client Authentication Buffer Overflow DoS

The vulnerability of the pkiverifydatasignature function in the LibSSH client authentication library is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and gain unauthorized access to protected...

CVE-2023-28801

An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r...

Input validation

An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r...

CVE-2023-28801 Improper SAML signature verification

An Improper Verification of Cryptographic Signature in the SAML authentication of the Zscaler Admin UI allows a Privilege Escalation.This issue affects Admin UI: from 6.2 before 6.2r...

CVE-2023-41037

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

CVE-2023-41037

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

CVE-2023-41037

OpenPGP.js vulnerability (CVE-2023-41037) in Cleartext Signed Messages: versions up to 5.9.0 ignore data before the Hash: header, enabling text insertion that appears signed. Impact arises if an app verifies only verificationResult.verified and visually trusts the message; otherwise, verified dat...

CVE-2023-23772: Improper Verification of Cryptographic Signature

Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a...

CVE-2023-41037: Improper Verification of Cryptographic Signature

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. In affected versions OpenPGP Cleartext Signed Messages are cryptographically signed messages where the signed text is readable without special tools. These messages typically contain a "Hash: ..." header declaring the hash algorit...

PT-2023-12420

Name of the Vulnerable Software and Affected Versions App Lounge versions prior to 0.19q Description The issue arises from improper verification of applications' cryptographic signatures in the App Lounge client. This allows attackers who control the application server to install malicious...

App Lounge data falsification vulnerability

App Lounge is the second iteration of the app store embedded in /e/OS from the /e/ team. It allows everyone to access millions of apps directly from their phone's home screen. A security vulnerability exists in versions prior to App Lounge 0.19q that stems from not properly verifying an...

CVE-2021-43171: Improper Verification of Cryptographic Signature

Improper verification of applications' cryptographic signatures in the /e/OS app store client App Lounge before 0.19q allows attackers in control of the application server to install malicious applications on user's systems by altering the server's API response...

CVE-2023-39392: Improper Verification of Cryptographic Signature

Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciously modified and overwritten...