USN-5388-2: OpenJDK vulnerabilities

It was discovered that OpenJDK incorrectly verified ECDSA signatures. An attacker could use this issue to bypass the signature verification process. CVE-2022-21449 It was discovered that OpenJDK incorrectly limited memory when compiling a specially crafted XPath expression. An attacker could...

Huawei EulerOS: Security Advisory for perl-App-cpanminus (EulerOS-SA-2022-1579)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP8 : perl-App-cpanminus (EulerOS-SA-2022-1579)

According to the versions of the perl-App-cpanminus package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. CVE-2020-16154 Note that Tenable Network Security ha...

The vulnerability of the ECDSA digital signature algorithm implementation in Oracle Java SE software and the Oracle GraalVM Enterprise Edition virtual machine allows a perpetrator to compromise the confidentiality, integrity, and accessibility of information.

The vulnerability of the ECDSA digital signature algorithm implementation in Oracle Java SE software and the Oracle GraalVM Enterprise Edition virtual machine is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to compromise th...

Oracle OpenJDK ECDSA Signatures Vulnerability (CVE-2022-21449)

Oracle OpenJDK is prone to vulnerability in the implementation of ECDSA signature verification Component: security-libs/java.security. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

The vulnerability of the microprogramming software check function for Cisco Small Business routers such as RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P allows attackers to install and load malicious software or execute unsigned binary files on vulnerable devices.

The vulnerability of the microprogramming software-based image verification function in Cisco Small Business RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P routers is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow...

OpenJDK: Improper ECDSA signature verification (Libraries, 8277233)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 17.0.2 and 18; Oracle GraalVM Enterprise Edition: 21.3.1 and 22.0.0.2. Easily exploitable vulnerability allows...

Important: java-17-openjdk security and bug fix update

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: Improper ECDSA signature verification Libraries, 8277233 CVE-2022-21449 OpenJDK: Defective secure validation in Apache Santuario Libraries, 82780...

The vulnerability of the signature-verification function in the PHP programming language interpreter arises from buffer overflows, which allow attackers to trigger a service failure or potentially cause other adverse effects.

The vulnerability of the signature-verification function in the PHP programming language interpreter arises due to buffer overflow. Exploiting this vulnerability can allow an attacker to cause service failures or potentially have other adverse effects...

The vulnerability of the FortiOS operating system’s signature verification function allows a hacker to execute arbitrary code.

The vulnerability of the FortiOS operating system’s signature verification function is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially created installation images...

CVE-2020-25166

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to generate valid firmware updates with arbitrary content that can be used to tamper...

The vulnerability of the LibreOffice office software package lies in its improper verification of the cryptographic signature, allowing a hacker to circumvent security restrictions.

The vulnerability of the LibreOffice office software package is related to incorrect verification of the cryptographic signature when using the “X509Data” and “KeyValue” values. Exploiting this vulnerability can allow an attacker to circumvent security restrictions by using a specially created OD...

CVE-2021-30066

The CVE-2021-30066 entry applies to Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 (before 03.23) and Belden Tofino Xenon Security Appliance. A firmware-signature verification bypass for USB allows loading an arbitrary firmware image, enabling kernel/firmware upgrades with unsigned p...

CVE-2021-30066

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...

The vulnerability of the Mozilla Firefox browser, related to the race-like status during signature verification, allows a hacker to perform a spoofing attack.

The vulnerability of the Mozilla Firefox browser is related to a race condition that occurs during the process of checking signatures. Exploiting this vulnerability allows an attacker to perform a spoofing attack by replacing the default configuration file with a malicious one...

CVE-2022-24773

A flaw was found in the node-forge library when verifying the signature on the ASN.1 structure in RSA PKCS1 v1.5. This flaw allows an attacker to obtain successful verification for invalid DigestInfo structure, affecting the integrity of the attacked resource...

CVE-2022-24772

A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature...

CVE-2022-24771

A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature...

Digital Bazaar Forge Data Forgery Issue Vulnerability (CNVD-2022-22656)

Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and network-intensive Web applications from Digital Bazaar, Inc. A data forgery issue vulnerability exists in versions prior to Digital Bazaar Forge 1.3.0, which originated in...

Digital Bazaar Forge Data Forgery Issue Vulnerability

Digital Bazaar Forge is a native implementation of Tls in Javascript and an open source tool for writing encryption-based and network-intensive Web applications from Digital Bazaar, Inc. digitalbazaar Forge versions prior to 1.3.0 are vulnerable to a data forgery issue that originates from RSA PK...