4204 matches found
CVE-2015-6033
Qolsys IQ Panel aka QOL before 1.5.1 does not verify the digital signatures of software updates, which allows man-in-the-middle attackers to bypass intended access restrictions via a modified update...
The vulnerability of the Ubuntu operating system allows a hacker to use a mirror server to replace the disk images.
The vulnerability of the Simple Streams library is related to errors in the process of checking GPG signatures for disk image files. Exploiting this vulnerability allows a malicious actor, operating remotely, to use a mirrored server to replace disk images through an HTTP response with an "403"...
The vulnerability of the iOS operating system, which allows a hacker to bypass the signature verification mechanism for security checks
The vulnerability of the dyld component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the code signing verification mechanism by using a specially crafted application that embeds the signature within the...
PT-2015-2247
Name of the Vulnerable Software and Affected Versions Simple Streams simplestreams affected versions not specified Description The issue is related to the improper verification of GPG signatures of disk image files. This allows remote mirror servers to spoof disk images, potentially having other...
Medium: nss-softokn
Issue Overview: A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks. Affected Packages: nss-softokn Issue Correction: Run yum update nss-softokn...
Apple iOS Executable Program Code Signature Verification Vulnerability
Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in Apple iOS Verify Code Signature. The vulnerability allows an attacker to bypass the code signature...
RHEL 6 / 7 : nss-softokn (RHSA-2015:1699)
The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1699 advisory. Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server...
Scientific Linux Security Update : nss on SL5.x i386/x86_64 (20150824)
It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward- secrecy of a TLS/SSL connection. CVE-2015-2721 A flaw was found in the way NSS...
python-oauth2: _check_signature() ignores the nonce value when validating signed urls
It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...
Design/Logic Flaw
NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...
CVE-2015-2964
NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...
CVE-2015-2964: Improper Input Validation
NAMSHI | JOSE 5.0.0 and earlier allows remote attackers to bypass signature verification via crafted tokens in a JSON Web Tokens JWT header...
CVE-2015-3714: Undefined Security Weakness
Apple OS X before 10.10.4 does not properly consider custom resource rules during app signature verification, which allows attackers to bypass intended launch restrictions via a modified app...
namshi/jose fails to verify token signatures
Overview namshi/jose is a PHP library for handling JSON Web Tokens JWT. namshi/jose contains a vulnerability in processing JWT headers where it fails to verify token signatures. Toshiharu Sugiyama of DeNA Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...
DSA-3293-1 pyjwt - security update
Bulletin has no description...
CVE-2015-2951
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...
Design/Logic Flaw
JWT.php in F21 JWT before 2.0 allows remote attackers to bypass signature verification via crafted tokens...
CVE-2015-2951
The CVE-2015-2951 detail involves the F21 JWT PHP library (JWT.php) where versions before 2.0 fail to verify token signatures, enabling remote attackers to bypass signature verification via crafted tokens. Affected component is the PHP JWT token processor; root cause is signature verification byp...