BIT-MAGENTO-2020-9588

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

BIT-MAGENTO-2020-9690

Magento versions 2.3.5 and earlier, and 2.3.5 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass...

PT-2024-13626

Name of the Vulnerable Software and Affected Versions go-saml versions all known versions Description The go-saml library contains an authentication bypass issue due to the internal use of the xmlsec1 command line tool to verify SAML assertions without restricting the origin of the public key for...

go-saml security vulnerability

go-saml is a sufficiently good SAML client library written in Go open-sourced by Robots and Pencils. A security vulnerability exists in go-saml that stems from an application contains a SAML authentication bypass vulnerability that could lead to an application authentication bypass using go-saml...

Moderate: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: golang: net/http/internal: Denial of Service DoS via Resource Consumption via HTTP requests CVE-2023-39326 For more details about...

Authentication Bypass

Amendment This was deemed not a vulnerability. Overview hawkauthlib is a Hawk Access Authentication protocol Affected versions of this package are vulnerable to Authentication Bypass. The incoming client supplied hash of the payload is trusted by the server and not verified before the signature i...

Authentication Bypass

Amendment This was deemed not a vulnerability. Overview PyHawk is a Python libraries for the 'HAWK' HTTP authentication scheme Affected versions of this package are vulnerable to Authentication Bypass. The incoming client supplied hash of the payload is trusted by the server and not verified befo...

svix vulnerable to Authentication Bypass

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...

CVE-2024-21491

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...

CVE-2024-21491

SVIX before version 1.17.0 is affected by an authentication bypass vulnerability in the Webhook verification logic. The root cause is an incorrect comparison of signatures of different lengths in the verify function, allowing an attacker to bypass signature verification by supplying a shorter sig...

CVE-2024-21491

Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...

CVE-2024-25714

CVE-2024-25714 affects Rhonabwy up to 1.1.13. The HMAC signature verification uses a strcmp-based comparison that can leak timing information via a side-channel, as it stops at the first difference. The documented fix replaces this with a constant-time function (gnutls_memcmp). No exploitation de...

PT-2024-21109 · Rhonabwy +1 · Rhonabwy +1

Name of the Vulnerable Software and Affected Versions: Rhonabwy versions 1.1.13 and earlier Description: The issue is related to HMAC signature verification, which uses a strcmp function. This function is vulnerable to side-channel attacks because it stops the comparison when the first difference...

CVE-2024-1150

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1...

Information disclosure

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1...

PT-2024-17034 · Snow · Snow Software Inventory Agent

Name of the Vulnerable Software and Affected Versions: Snow Software Inventory Agent on Unix versions through 7.3.1 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability, which allows File Manipulation through Snow Update Packages. Recommendations:...

Buffer overflow

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

CVE-2023-51437 Apache Pulsar: Timing attack in SASL token signature verification

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

PT-2024-1615

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Service Platform affected versions not specified Description The issue is related to incorrect cryptographic signature verification in the FactoryTalk Services Platform, which can allow a remote attacker to gain...