CVE-2021-4126

The CVE-2021-4126 issue affects Thunderbird: when receiving an OpenPGP/MIME signed email with an outer MIME layer (e.g., mailing list footer), Thunderbird incorrectly treated inner content as signed. The root cause is that the displayed signature status was based on the inner part; since 91.4.1, ...

PT-2022-28078

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.8.3 through 1.8.4 Description An image signature validation bypass issue allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster. Th...

Schneider Electric EcoStruxure Operator Terminal Expert 数据伪造问题漏洞

Schneider Electric EcoStruxure Operator Terminal Expert is a touch screen configuration software from Schneider Electric, France. This software support is mainly used for creating and editing touch applications. A data forgery vulnerability exists in Schneider Electric EcoStruxure Operator Termin...

Linktree: Account takeover - improper validation of jwt signature (with regards to experiation date claim)

Some backend services did not properly validate JWTs. As a result JWT validation could be bypassed by setting the expiration date claim to a unix timestamp in the past, and abusing this for account takeover. The expiration date claim of the JWT token was not properly handled. I was able to bypass...

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

Design/Logic Flaw

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

CVE-2022-42789: Undefined Security Weakness

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-42793

CVE-2022-42793 concerns a vulnerability where code signing validation could be bypassed due to inadequate checks. The issue affects Apple platforms and was addressed by improving code signing validation in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7, iPadOS 15.7, and macOS Monterey 12....

CVE-2022-42789

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6. An app may be able to access user-sensitive data...

CVE-2022-42789

The CVE-2022-42789 entry concerns an issue in code signature validation that could allow an app to access user-sensitive data. Apple fixed the vulnerability in macOS Big Sur 11.7, macOS Monterey 12.6, and macOS Ventura 13, addressing the problem by enforcing improved checks during code signing va...

CVE-2022-42793

An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, macOS Monterey 12.6. An app may be able to bypass code signing checks...

GLSA-202210-22 : RPM: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202210-22 RPM: Multiple Vulnerabilities - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a binding signature. RPM does not check the binding signature of subkeys prior to...

GHSA-M5M3-46GJ-WCH8 SIF's Digital Signature Hash Algorithms Not Validated

Impact The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. Patches A patch is available in version = v2.8.1 of the module. Users are encouraged to upgrade. The patch is commit...

Security Bulletin: IBM Tivoli Federated Identity Manager OpenID: signature validation not applied to all attributes (CVE-2012-6359)

Abstract SUMMARY An OpenID message can be modified to contain unsigned attributes that will be accepted by a relying party because Tivoli Federated Identity Manager TFIM does not check that all attributes have been signed. Content VULNERABILITY DETAILS CVE: CVE-2012-6359 DESCRIPTION: An OpenID...

macOS 12.x < 12.6 Multiple Vulnerabilities (HT213444)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6. It is, therefore, affected by multiple vulnerabilities: - An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, macOS Monterey 12.6...

GO-2022-0945 Signature validation bypass in gopkg.in/square/go-jose.v1

The go-jose library suffers from multiple signatures exploitation. When validating a signed message, the API did not indicate which signature was valid, which creates the potential for confusion...

CVE-2022-28751

The Zoom Client for Meetings for MacOS Standard and for IT Admin before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...