USN-7025-1 libreoffice vulnerability

It was discovered that LibreOffice would incorrectly handle digital signature verification after repairing a corrupted document. A remote attacker could possibly use this issue to forge valid signatures...

Ubuntu 20.04 LTS / 22.04 LTS : LibreOffice vulnerability (USN-7025-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7025-1 advisory. It was discovered that LibreOffice would incorrectly handle digital signature verification after repairing a corrupted document. A remote attacker cou...

The vulnerability of the LibreOffice office software package lies in its improper verification of the cryptographic signature. This allows a malicious actor to create a specially crafted document. Upon restoration, such a document would indicate that the electronic signature status is valid.

The vulnerability of the LibreOffice office software package is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to create a specially crafted document. After restoration, such a document would indicate that the electronic...

The vulnerability of the SAML library for Ruby SAML and the Git-based software platform, which is used for collaborative code development on GitLab, allows for an increase in privileges.

The vulnerability of the SAML library for Ruby SAML applications and the Git-based software platform for collaborative code development on GitLab is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to increase their privileges...

CLSA-2024-1726583188 bind: Fix of 2 CVEs

CVE-2024-4076: avoid assertion failure from client queries triggering stale data and needing local zone lookups - CVE-2024-1975: remove support for SIG0 message verification...

The vulnerability of the Microsoft OneNote software for the Mac OS allows a hacker to circumvent existing security restrictions.

The vulnerability of the Microsoft OneNote note-taking software for the Mac OS is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by introducing malicious libraries...

Incorrect Access Control

Whatsapp-api-js is vulnerable to Incorrect Access Control. The vulnerability is due to improper validation of request signatures in the WhatsAppAPI.verifyRequestSignature method, which allows an attacker to bypass access controls by manipulating the signature verification process...

The vulnerability of the SAML SSO authentication mechanism in the corporate version of the GitHub Enterprise Server allows a perpetrator to gain access to a user account with administrator privileges.

The vulnerability of the SAML SSO authentication mechanism in the corporate version of the GitHub Enterprise Server is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to gain access to a user account with administrator...

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in = v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the...

SAML authentication bypass via Incorrect XPath selector

Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrar...

GHSA-JW9C-MFG7-9RX2 SAML authentication bypass via Incorrect XPath selector

Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrar...

CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

UBUNTU-CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

CVE-2024-45409

CVE-2024-45409 affects the Ruby-SAML library used for SAML client functionality. Ubuntu/Debian advisories and IBM/GitHub entries confirm that versions <= 12.2 and 1.13.0

CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

NewStart CGSL MAIN 6.02 : libdnf Vulnerability (NS-SA-2024-0056)

The remote NewStart CGSL host, running version MAIN 6.02, has libdnf packages installed that are affected by a vulnerability: - A flaw was found in libdnf's signature verification functionality. This flaw allows an attacker to achieve code execution if they can alter the header information of an...

NewStart CGSL MAIN 6.02 : dnf-plugins-core Vulnerability (NS-SA-2024-0064)

The remote NewStart CGSL host, running version MAIN 6.02, has dnf-plugins-core packages installed that are affected by a vulnerability: - A flaw was found in libdnf's signature verification functionality. This flaw allows an attacker to achieve code execution if they can alter the header...

GO-2024-3114 Nuclei Template Signature Verification Bypass in github.com/projectdiscovery/nuclei

Nuclei Template Signature Verification Bypass in github.com/projectdiscovery/nuclei...

Signature Verification Bypass

github.com/projectdiscovery/nuclei is vulnerable to Signature Verification Bypass. The vulnerability is caused due to a defect in the Nuclei's template signature verification system, allows an attacker to bypass the signature check and possibly execute malicious code via custom code template...