Incorrect threshold signature computation in TUF

Impact Metadadata signature verification, as used in tuf.client.updater, counted each of multiple signatures with identical authorized keyids separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the...

Pritunl-client Data Forgery Issue Vulnerability

Pritunl-client is an open source OpenVPN client application from the American company Pritunl. A security vulnerability exists in pritunl-client versions prior to 1.0.1116.6, which stems from a lack of signature verification in the program. An attacker can exploit this vulnerability to obtain...

CVE-2020-15827

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file...

CVE-2020-15827

JetBrains Toolbox 1.17 before 1.17.6856 had a signature verification issue: the set of verifications omitted the jetbrains-toolbox.exe. This concerns integrity checks. Remediation: upgrade to 1.17.6856 or newer per the JetBrains Security Bulletin Q2 2020.

DP3T-Backend-SDK Data Forgery Issue Vulnerability

DP3T-Backend-SDK is a backend implementation of DP3T Decentralized Privacy Preserving Neighborhood Tracking. A security vulnerability exists in DP3T-Backend-SDK versions prior to 1.1.1. An attacker can exploit the vulnerability to bypass signature checking...

grub2 data forgery issue vulnerability

grub2 is a Linux system bootloader from the GNU Project. A data forgery issue vulnerability exists in GRUB2 2.04 and earlier versions. The vulnerability stems from the program not verifying kernel signatures when booting directly without shim. An attacker could exploit this vulnerability to bypas...

Critical Magento Flaws Allow Code Execution

Critical flaws in Adobe’s Magento e-commerce platform – which is commonly targeted by attackers like the Magecart cybergang – could enable arbitrary code execution on affected systems. Magento is a popular, Adobe-owned open-source e-commerce platform that powers many online shops. Adobe on Tuesda...

CVE-2020-9690

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

CVE-2020-9690

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

Security feature bypass

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

CVE-2020-9690

The CVE-2020-9690 observable timing discrepancy affects Magento/OpenMage LTS: OpenMage LTS before 19.4.6 and 20.0.2 allows bypass of fromkey protection in Admin Interface, increasing CSRF risk; patched in 19.4.6 and 20.0.2. Details are tied to Adobe’s CVE-2020-9690; exploitation status is not pro...

CVE-2020-9690

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

APSB20-47 Security updates available for Magento

Magento has released updates for Magento Commerce 2 formerly known as Magento Enterprise Edition and Magento Open Source 2 formerly known as Magento Community Edition. These updates resolve vulnerabilities rated Important and Critical . Successful exploitation could lead to arbitrary code executi...

OPENSUSE-SU-2020:1100-1 Security update for singularity

This update for singularity fixes the following issues: - New version 3.6.0. This version introduces a new signature format for SIF images, and changes to the signing / verification code to address the following security problems: - CVE-2020-13845, boo1174150 In Singularity 3.x versions below...

CVE-2016-7064

A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage...

CVE-2016-7064

A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage...

Design/Logic Flaw

A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage...

CVE-2016-7064

A flaw was found in pritunl-client before version 1.0.1116.6. A lack of signature verification leads to sensitive information leakage...

CVE-2016-7064

CVE-2016-7064 affects the open-source Pritunl client: before version 1.0.1116.6, a lack of signature verification allows information leakage. Root cause: the client does not verify signatures on data/files, enabling potential exposure of sensitive information. Affected: pritunl-client versions pr...

proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. An attacker could use this flaw to crash or cause potential code execution in Go applications that use this library, under certain conditions, during GPG signature verification...