Improper JWT Signature Validation in SAP Security Services Library

Impact SAP BTP Security Services Integration Library Java cloud-security-services-integration-library allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. Patches Upgrade to...

Duplicate Advisory: Improper JWT Signature Validation in SAP Security Services Library

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-59c9-pxq8-9c73. This link is maintained to preserve external references. Original Description SAP BTP Security Services Integration Library Java cloud-security-services-integration-library - versions below 2.17....

CVE-2023-40090

In BTMBleVerifySignature of btmble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Design/Logic Flaw

In BTMBleVerifySignature of btmble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40090

What’s affected: Google Android platform vulnerability CVE-2023-40090 in the Bluetooth stack, specifically BTM_BleVerifySignature in btm_ble.cc. The issue is described as bypassing signature validation via side-channel information disclosure, enabling remote escalation of privilege with no additi...

PT-2023-27263 · Bluetooth · Bluetooth

Name of the Vulnerable Software and Affected Versions: Bluetooth software affected versions not specified Description: The issue is related to a possible way to bypass signature validation due to side channel information disclosure in the BTM BleVerifySignature function of btm ble.cc. This could...

CVE-2023-40090: Observable Discrepancy

In BTMBleVerifySignature of btmble.cc, there is a possible way to bypass signature validation due to side channel information disclosure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-49095 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2...

CVE-2023-49095 nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2...

CVE-2023-49079

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

Design/Logic Flaw

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079

Misskey (open source, decentralized social platform) has a vulnerability due to missing signature validation that allows an arbitrary user to impersonate any remote user. Concrete details across multiple connected sources indicate this affects Misskey versions prior to 2023.11.1-beta.1, with the ...

CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

CVE-2023-49079 Misskey's missing signature validation allows arbitrary users to impersonate any remote user.

Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. This issue has been patched in version 2023.11.1-beta.1...

Improper Signature Validation

simplesamlphp/xml-security and simplesamlphp/saml2 are vulnerable to Improper Signature Validation. The vulnerability is due to a lack of proper signature validation in the validateReference method. This could lead to the forging of digital signatures...

PT-2023-31047 · Misskey · Misskey

Name of the Vulnerable Software and Affected Versions: Misskey versions prior to 2023.11.1-beta.1 Description: Misskey is an open source, decentralized social media platform. The issue allows arbitrary users to impersonate any remote user due to missing signature validation. Recommendations: For...

CVE-2023-20567

Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDSoftwareInstaller.exe without validating the file signature potentially leading to arbitrary code execution...

Improper Signature Validation

aws-database-encryption-sdk-dynamodb is vulnerable to Improper Signature Validation. The vulnerability occurs when a Set type is assigned a SIGNONLY attribute action. In such cases, there is a chance that the signature validation of the record containing a Set may fail during read, even if the Se...

In _executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values.

Lines of code Vulnerability details M5 - In executeSetSignatureValidator, validate data.signatureHash and data.signatureValidator for non-zero values. poc: solidity function executeSetSignatureValidator internal returns bytes memory nextProgressData requiredata.signatureHash != bytes320, "Signatu...

wrong return value of totalVotingPower leads to break the OffChainSignatureValidator#isValidSignature() functionality

Lines of code Vulnerability details Bug Description in the OffChainSignatureValidatorisValidSignature function we returns the singerVotingPowerBPS in term of BPSpoints by mul it by 1000 and the totalVotingPower is returned by calling the party.getGovernanceValues.totalVotingPower which is normal...