Upgraded Q -> 2 from #504 [1676216850158]

Judge has assessed an item in Issue 504 as 2 risk. The relevant finding follows: Incorrect signature check in the validatePaymasterUserOp function --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2023-23928 reason-jose ignores signature checks

reason-jose is a JOSE implementation in ReasonML and OCaml.Jose.Jws.validate does not check HS256 signatures. This allows tampering of JWS header and payload data if the service does not perform additional checks. Such tampering could expose applications using reason-jose to authorization bypass...

EulerOS Virtualization 3.0.2.2 : rpm (EulerOS-SA-2023-1306)

According to the versions of the rpm packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a...

CVE-2022-2484

The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs...

CVE-2022-2484

The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs...

CVE-2022-2484

The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could result in the execution of a malicious kernel, arbitrary programs, or modified Nokia programs...

CVE-2022-2484

The vulnerability CVE-2022-2484 affects Nokia ASIK AirScale system module version 474021A.101. The Red Hat/CISA/NVD records describe a bypass of the module’s signature check, enabling an attacker to run modified firmware, which could lead to execution of a malicious kernel, arbitrary programs, or...

Code injection

TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service DoS by uploading a crafted firmware update because the signature check is inadequate...

PT-2022-28119 · Tp Link · Tp-Link Tl-Wr902Ac

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR902AC devices through V3 0.9.1 Description: The issue allows remote authenticated attackers to execute arbitrary code or cause a Denial of Service DoS by uploading a crafted firmware update because the signature check is...

CVE-2022-48194

CVE-2022-48194 affects TP-Link TL-WR902AC devices running V3 0.9.1. An authenticated attacker can upload a crafted firmware update to achieve remote code execution or DoS due to an inadequate firmware-signature check. The vulnerability is demonstrated in public writeups/exploits (e.g., Exploit-DB...

TP-LINK TL-WR902AC 代码问题漏洞

The TP-LINK TL-WR902AC is an Ac750 Travel Router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK TL-WR902AC V3 prior to version 0.9.1, which stems from inadequate signature checking, and can be exploited by an attacker to execute arbitrary code or cause a denial of service...

Nokia ASIK AirScale 5G Common System Module 安全漏洞

The Nokia ASIK AirScale 5G Common System Module is a common system unit from Nokia, Finland. A security vulnerability exists in Nokia ASIK AirScale 5G Common System Module version 474021A.101, which stems from a signature check that can be bypassed to allow an attacker to run modified firmware...

CVE-2022-39366 DataHub missing JWT signature check

DataHub is an open-source metadata platform. Prior to version 0.8.45, the StatelessTokenService of the DataHub metadata service GMS does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This...

The vulnerability of the implementation of the shim_lock verification mechanism in the Grub2 operating system allows a perpetrator to execute arbitrary code and gain full control over the device.

The vulnerability of the shimlock verification mechanism in the Grub2 operating system’s loader is related to incorrect checking of the cryptographic signature. Exploiting this vulnerability allows an attacker to execute arbitrary code and gain full control over the device...

Dendrite signature checks not applied to some retrieved missing events

Impact Events retrieved from a remote homeserver using /getmissingevents did not have their signatures verified correctly. This could potentially allow a remote homeserver to provide invalid/modified events to Dendrite via this endpoint. Note that this does not apply to events retrieved through...

Security update for libsolv, libzypp, zypper (important)

openSUSE Security Update: Security update for libsolv, libzypp, zypper Announcement ID: openSUSE-SU-2022:1157-1 Rating: important References: 1184501 1194848 1195999 1196061 1196317 1196368 1196514 1196925 1197134 Affected Products: openSUSE Leap Micro 5.2 An update that contains security fixes c...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20201105.2267)

The version of AHV installed on the remote host is prior to 20201105.2267. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20201105.2267 advisory. - NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when...

PT-2022-4376 · Zoom · Zoom Rooms For Conference Room For Windows +1

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 Zoom Client for Meetings for macOS affected versions not specified Description: The issue is related to a Local Privilege Escalation vulnerability that could be exploited by a...

openSUSE: Security Advisory for libsolv, (SUSE-SU-2022:1157-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-28790

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The patch adds proper caller signature check logic...