PT-2023-2222 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches versions prior to 16.11.1 Description: A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker...

Signature Verification Bypass

thunderbird is vulnerable to Signature Verification Bypass. Certificate OCSP revocation status was not checked when verifying S/Mime signatures which allows mails signed with a revoked certificate to be displayed as having a valid signature...

CVE-2022-20929

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade...

Design/Logic Flaw

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade...

Incorrect EIP1271 magic value returned from DAO.isValidSignature

Lines of code Vulnerability details Impact An unexpected return value from the EIP1271 signature verification can lead to authorization for unwanted operations in external protocols. Proof of Concept As shown in the EIP1271 standard specification, when a signature is not valid, the returned magic...

ABB Relion 670 Series and Relion 650 Series have vulnerabilities related to data falsification.

The ABB Relion 670 Series is a transmission protection control device from ABB Switzerland. A security vulnerability exists in the Relion 670, 650, and SAM600-IO series due to an incorrect access control included in the signature verification of Hitachi Energy Relion update packages. A tampered...

CVE-2022-20929

CVE-2022-20929 concerns Cisco Enterprise NFV Infrastructure Software (NFVIS) where upgrade signature verification is insufficient. The issue allows an unauthenticated, local attacker to supply an unauthentic upgrade file for upload, potentially leading to full system compromise. Affected componen...

CVE-2022-20929

A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an unauthenticated, local attacker to provide an unauthentic upgrade file for upload. This vulnerability is due to insufficient cryptographic signature verification of upgrade...

Cisco IOS XE System Check Code Execution

The vulnerability of the Cisco IOS XE software’s network device authentication function on the Cisco Catalyst 9200 series devices is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows an attacker to execute arbitrary code...

FortiOS FortiWeb FortiSwitch FortiProxy Information Disclosure

Vulnerabilities of FortiOS operating systems, FortiWeb network firewalls for web applications, FortiSwitch Ethernet switches, and FortiProxy proxy servers are related to improper verification of cryptographic signatures. Exploiting these vulnerabilities can allow attackers to disclose sensitive...

Dell Command Update Improper Signature Code Execution

The vulnerability of the Dell Command | Update, Dell Update, and Alienware Update programs is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Denial Of Service (DoS)

github.com/notaryproject/notation-go is vulnerable to Denial of Service DoS attacks. A malicious user is able to exhaust memory through the signature verification component, either resulting in high memory load or an application crash...

CVE-2022-4203

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate...

K33101555: Nettle cryptography library vulnerability CVE-2021-20305

Security Advisory Description A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in...

K14261: OpenSSL OCSP vulnerability CVE-2013-0166

Security Advisory Description OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for Online Certificate Status Protocol OCSP responses, which allow remote attackers to cause a denial-of-service DoS NULL pointer dereference and...

K39712275: PHP vulnerability CVE-2016-7414

Security Advisory Description The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressedfilesize field is large enough, which allows remote attackers to cause a denial of service out-of-bounds memory access or possibly have unspecified...

K11910343: Linux kernel vulnerability CVE-2021-35039

Security Advisory Description kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CONFIGMODULESIG, verification that a kernel module is signed, for loading via initmodule, does not occur for a module.sigenforce=1 command-line argumen...

CVE-2023-25656

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...

CVE-2023-25656

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...

Design/Logic Flaw

notation-go is a collection of libraries for supporting Notation sign, verify, push, and pull of oci artifacts. Prior to version 1.0.0-rc.3, notation-go users will find their application using excessive memory when verifying signatures. The application will be killed, and thus availability is...