CVE-2024-40592

An improper verification of cryptographic signature vulnerability CWE-347 in FortiClient MacOS version 7.4.0, version 7.2.4 and below, version 7.0.10 and below, version 6.4.10 and below may allow a local authenticated attacker to swap the installer with a malicious package via a race condition...

Moderate: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Fortinet FortiClient - Missing signature verification (FG-IR-24-022) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-022 advisory. - An improper verification of cryptographic signature vulnerability CWE-347 in FortiClient MacOS version 7.4.0, version 7.2...

PT-2024-8517 · Fortinet · Forticlient

Name of the Vulnerable Software and Affected Versions: FortiClient MacOS versions 7.4.0, 7.2.4 and below, 7.0.10 and below, 6.4.10 and below Description: The issue is related to an improper verification of cryptographic signature, which may allow a local authenticated attacker to swap the install...

[SECURITY] [DLA 3949-1] ruby-saml security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3949-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA November 11, 2024 https://wiki.debian.org/LTS -...

The vulnerability of the TeamViewer_service.exe executable file of the remote control software allows a hacker to gain increased privileges.

The vulnerability of the TeamViewerservice.exe executable file of the remote control software involves incorrect verification of the cryptographic signature. Exploiting this vulnerability can allow attackers to increase their privileges...

CVE-2024-47073

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-47073 Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-47073

DataEase v2.10.2 and earlier suffer from a missing JWT signature verification that lets an attacker forge tokens to access any interface. Multiple connected sources (including Nuclei template, Red Hat advisory, CVE listings) confirm the root cause as lack of signature verification and indicate th...

SUSE CVE-2024-51746

Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are returned by the log. gitsign uses Rekor's search API to fetch entries that apply to a signature...

DataEase 数据伪造问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends to achieve business improvement and optimization. DataEase v2.10.2 version before the data forgery problem vulnerability ,...

PT-2024-34879 · Gitsign +1 · Gitsign +1

Name of the Vulnerable Software and Affected Versions: gitsign affected versions not specified Description: The issue arises when gitsign uses Rekor's search API to fetch entries for signature verification, using parameters such as the public key and the payload. However, the search API returns...

keycloak-saml-core: Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Laravel Reverb Missing API Signature Verification

Impact A community member disclosed an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message from a backend service or for obtaining statistical information such as number of...

CVE-2024-50347 Laravel Reverb has Missing API Signature Verification

Laravel Reverb provides a real-time WebSocket communication backend for Laravel applications. Prior to 1.4.0, there is an issue where verification signatures for requests sent to Reverb's Pusher-compatible API were not being verified. This API is used in scenarios such as broadcasting a message...

RHEL 8 : grafana (RHSA-2024:8507)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8507 advisory. Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: elliptic: Missing...

Fortinet Fortigate Heap-based Buffer Overflow in firmware signature verification (FG-IR-21-115)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-115 advisory. - A heap-based buffer overflow in the firmware signature verification function of FortiOS versions 7.0.1, 7.0.0, 6.4.0 throug...

skopeo security update

An update is available for skopeo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The skopeo command lets you inspect images from container image registries, ge...

PT-2025-3198

Name of the Vulnerable Software and Affected Versions AMD CPU versions affected versions not specified Description The issue is related to improper signature verification in the AMD CPU ROM microcode patch loader, which may allow an attacker with local administrator privilege to load malicious CP...

The vulnerability of the SAML SSO authentication mechanism in the corporate version of the GitHub Enterprise Server allows attackers to escalate their privileges and disclose sensitive information.

The vulnerability of the SAML SSO authentication mechanism in the corporate version of the GitHub Enterprise Server is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to increase their privileges and disclose sensitive...