Cargo Package Manager Data Compromise

The vulnerability of the Cargo package manager in the Rust programming language is related to incorrect verification of the cryptographic signature. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information via the SSH protocol...

CVE-2023-0401

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...

CVE-2023-0401 NULL dereference during PKCS7 data verification

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...

CVE-2022-4203

A flaw was found in Open SSL. A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the...

CVE-2023-0401

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...

UBUNTU-CVE-2023-0401

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail...

Rocky Linux 8 : thunderbird (RLSA-2023:0606)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:0606 advisory. - Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a vali...

CVE-2021-36226: Improper Verification of Cryptographic Signature

Western Digital My Cloud devices before OS5 do not use cryptographically signed Firmware upgrade files...

libssh2 Man-in-the-Middle

The vulnerability of the libssh2 library, which implements Git methods in C using Libgit2, is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

CVE-2023-23928: Improper Verification of Cryptographic Signature

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

Reason-Jose data falsification vulnerability

reason-jose is a JavaScript object signature and encryption by Ulrik Strid Personal Developer. Reason-jose is vulnerable to a data forgery issue that stems from not checking HS256 signatures. An attacker exploiting this vulnerability could tamper with JWS headers and valid data...

Ubuntu: Security Advisory (USN-5230-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-26391

A flaw was found in hw. Insufficient verification of multiple header signatures while loading a Trusted Application TA may allow an attacker with privileges to gain code execution in that TA or the OS/kernel. Mitigation Please contact AMD for more updates on this flaw...

The _verifySignature function skips signature verification if the offerer is the caller.

Lines of code Vulnerability details Impact it could have a significant impact on the security of the smart contract. The function is intended to verify the signature of an order, but if the offerer is the caller, the function skips the signature verification. This could allow someone other than t...

Unauthorized Access in _verifySignature function due to improper use of msg.sender.

Lines of code Vulnerability details Impact if unmaskedAddressComparisonofferer, msg.sender return; If an attacker is able to call this function and make the msg.sender match the offerer, they will bypass the signature verification check and may be able to execute the contract's functionality as i...

Lack of owner verification in EIP-1271 signature check

Lines of code Vulnerability details Description In the checkSignatures there are checks that the signer is the account owner, but in the case of EIP-1271 signature check there are no such checks: // If v is 0 then it is a contract signature // When handling contract signatures the address of the...

CVE-2022-23539

A flaw was found in the jsonwebtoken package. The affected versions of the jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm...

Signature Validation Bypass

jsonwebtoken is vulnerable to signature validation bypass. The lack of algorithm definition in the jwt.verify function leads to signature validation bypass due to defaulting to the none algorithm for signature verification, which allows an attacker to bypass the verification mechanism...

JSONWebToken encryption vulnerability

jsonwebtoken is a JSON Web token implementation from Auth0 Open Source. A cryptographic issue vulnerability exists in jsonwebtoken version 8.5.1 and prior versions, which stems from old, insecure key types used for signature verification...

CVE-2022-23539 jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...