Gradle data manipulation vulnerability

Gradle is a set of JVM-based project building tools from the US company Gradle, which supports maven, Ivy repositories and more. A security vulnerability exists in Gradle versions prior to 7.5, which stems from the fact that dependency validation can ignore checksum validation when signature...

CVE-2022-34763

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V2.01 and later, OPC UA Modicon...

CVE-2022-34763

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature. Affected Products: X80 advanced RTU Communication Module BMENOR2200H V2.01 and later, OPC UA Modicon...

RSA BSAFE Micro Edition Code Execution

The vulnerability of the RSA BSAFE Micro Edition Suite and BSAFE Crypto-C Micro Edition security tools is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code in the context of the current user...

IDToken verifier Arbitrary File Load

The vulnerability of the IDToken verifier in the client Java OAuth library is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to download arbitrary files remotely...

PT-2022-3625

Name of the Vulnerable Software and Affected Versions X80 advanced RTU Communication Module versions 2.01 and later OPC UA Modicon Communication Module versions 1.10 and prior Description A vulnerability exists due to insufficient verification of data authenticity, which could cause the loading o...

PT-2022-3586 · Dell +1 · Dell Bsafe Crypto-C Micro Edition +2

Name of the Vulnerable Software and Affected Versions: Dell BSAFE Crypto-C Micro Edition versions prior to 4.1.5 Dell BSAFE Micro Edition Suite versions prior to 4.5.2 Description: The issue is related to improper input validation, which can allow a remote attacker to execute arbitrary code in th...

google-oauth-client: Token signature not verified

A flaw was found in Google OAuth Java client's IDToken verifier, where it does not verify if the token is properly signed. This issue could allow an attacker to provide a compromised token with a custom payload that will pass the validation on the client side, allowing access to information outsi...

openSUSE: Security Advisory for openssl-3 (SUSE-SU-2022:2306-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE-SU-2022:2306-1 Security update for openssl-3

This update for openssl-3 fixes the following issues: - CVE-2022-2068: Fixed more shell code injection issues in crehash. bsc1200550 - CVE-2022-1292: Properly sanitise shell metacharacters in crehash script. bsc1199166 - CVE-2022-1343: Fixed incorrect signature verification in OCSPbasicverify...

Insecure Signature Verification

jsrsasign is vulnerable to insecure signature verification. The vulnerability exists because the library does not properly validate the JWS or JWT signature with non-Base64URL encoding special characters or number escaped characters such as !@$% or \11...

PT-2022-17594

Name of the Vulnerable Software and Affected Versions jsrsasign versions prior to 10.5.25 Description The issue concerns improper verification of cryptographic signatures. Specifically, JWS or JWT signatures with non-Base64URL encoding special characters or number escaped characters may be...

Authenticode Signature Verification Code Execution

The vulnerability of the Authenticode signature verification function in the Windows operating system exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Qualcomm chip data falsification vulnerability

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits including primarily semiconductor devices, but also passive components, etc., and from time to time are manufactured on the surface of semiconductor wafers. A data forgery problem vulnerability exists in sever...

Qualcomm chip data falsification vulnerability

A Qualcomm chip is a chip from Qualcomm Incorporated USA. A way to miniaturize circuits including primarily semiconductor devices, but also passive components, etc., and from time to time are manufactured on the surface of semiconductor wafers. A data forgery issue vulnerability exists in multipl...

ecdsa-elixir fails to check signatures, vulnerable to message forging

Summary Stark Bank is a financial technology company that provides services to simplify and automate digital banking, by providing APIs to perform operations such as payments and transfers. In addition, Stark Bank maintains a number of cryptographic libraries to perform cryptographic signing and...

GHSA-XGP9-J48H-JJF9 Magento observable timing discrepancy vulnerability

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

Magento observable timing discrepancy vulnerability

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

Magento Signature verification bypass

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

GHSA-J2R4-2CR6-H3R3 Magento Signature verification bypass

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...