GO-2023-1826 Signature validation bypass in github.com/moov-io/signedxml

Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the...

Signature Validation Bypass

djangoses is vulnerable to Signature Validation Bypass. The vulnerability exists in utils.py due to a lack of validation in AWS certificates because an attacker can specify arbitrary public certificates...

GHSA-JQVR-J2VG-GJRV Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205: Improper Verification of Cryptographic Signature

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

CVE-2023-34205 affects moov-io/signedxml up to version 1.0.0, where parsing raw vs canonicalized XML can produce different outputs, enabling a Signature Wrapping (XSW) bypass of signature validation. The issue is documented across multiple feeds (NVD, Red Hat, GHSA, OSV) with a high CVSS (CRITICA...

It is possible that recovery transaction cannot be performed even if signer still controls address that is an address of recoveryInfo.keys

Lines of code Vulnerability details Impact When a signer's privileged address is compromised, this signer can call the following AmbireAccount.execute function with sigMode being SIGMODERECOVER by using a signature signed by an address of recoveryInfo.keys that is still controlled by such signer ...

CVE-2021-26365

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents...

CVE-2021-26365

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents...

Design/Logic Flaw

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents...

CVE-2021-26365

CVE-2021-26365 concerns AMD Secure Processor (ASP) and AMD System Management Unit (SMU) firmware where certain size values in firmware binary headers can cause out-of-bounds reads during signature validation, potentially enabling denial of service or leakage of memory contents. Public references ...

CVE-2021-26365

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents...

PT-2023-12092 · Amd · Amd Athlon 3000 Series Mobile Processors With Radeon Graphics Pollock +37

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to certain size values in firmware binary headers that could trigger out of bounds reads during signature validation. This can lead...

CVE-2021-26365: Out-of-bounds Read

Certain size values in firmware binary headers could trigger out of bounds reads during signature validation, leading to denial of service or potentially limited leakage of information about out-of-bounds memory contents...

Dell EMC ECS 数据伪造问题漏洞

The Dell EMC ECS is a storage device from Dell USA. A cryptographic issue vulnerability exists in Dell EMC ECS versions prior to 3.8.0.2, which stems from incorrect validation of cryptographic signatures. An attacker exploiting this vulnerability could modify the subject data of a request...

Unable to launch ICA session due to wfica32.exe signature validation failure

After upgrading Citrix Workspace App to 2203 CU2 and 2210.5 and above in customer's client machine, ICA session became unable to launch. Specifically, ICA file can be downloaded but wfica32.exe never starts. The issue doesn't occur in the same client machine with Citrix Workspace App for Windows...

Debian: Security Advisory (DLA-798-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

implementation of the isValidSignature() function in the DAO.sol is invalid

Lines of code Vulnerability details Impact Failure to validate the returned response from the isValidSignature function can cause that invalid signatures to be assumed to be valid. Proof of Concept Currently, externally owned accounts EOAs can sign messages with their associated private keys, but...