Path traversal

IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path traversal attacks. IBM X-Force ID: 192905...

CVE-2020-4993

IBM QRadar SIEM 7.3 and 7.4 when decompressing or verifying signature of zip files processes data in a way that may be vulnerable to path traversal attacks. IBM X-Force ID: 192905...

IBM QRadar SIEM 路径遍历漏洞

QRadar SIEM is an IBM enterprise security information and event management product that consolidates log event and network flow data from thousands of devices, endpoints and applications scattered across the network. A path traversal vulnerability exists in the way IBM QRadar SIEM versions 7.3 an...

Security Bulletin: GO is is vulnerable to a denial of service on IBM Watson Machine Learning on CP4D

Summary Golang golang.org/x/crypto is vulnerable to a denial of service, caused by an error during signature verification in the golang.org/x/crypto/ssh package on IBM Watson Machine Learning on CP4D Vulnerability Details CVEID: CVE-2020-9283 DESCRIPTION: Golang golang.org/x/crypto is vulnerable ...

Huawei EulerOS: Security Advisory for icedtea-web (EulerOS-SA-2021-1800)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Windows UAC Privilege Escalation

Hi @ll, Microsoft still ships Windows with and lets it create user-writable directories below the "Windows" directory %SystemRoot%\ -- despite that, with exception of %SystemRoot%\Temp, they are all used to store DATA and SHOULD have been placed below %ProgramData% alias %SystemDrive%\ProgramData...

EulerOS 2.0 SP3 : curl (EulerOS-SA-2021-1774)

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification CURLOPTSSLVERIFYPEER, also disables the...

Updated thunderbird packages fix security vulnerabilities

More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine CVE-2021-23961. Out of...

USN-4892-1 openjdk-8, openjdk-lts vulnerability

It was discovered that OpenJDK incorrectly verified Jar signatures. An attacker could possibly use this issue to bypass intended security restrictions when using Jar files signed with a disabled algorithm...

Apple watchOS 数据伪造问题漏洞

Apple watchOS is an operating system for smartwatches from Apple. A data forgery vulnerability exists in watchOS, which stems from improper signature verification in the AppleMobileFileIntegrity component. The following products and versions are affected: watchOS: 7.0 18R382, 7.0.1 18R395, 7.0.2...

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

Mozilla: Race condition when reading from disk while verifying signatures

Signatures are written to disk before and read during verification, which might be subject to a race condition when a malicious local process or user is replacing the file. This vulnerability affects Thunderbird 78.10...

Signature Verification Bypass

evolution is vulnerable to signature verification bypass. A "Valid signature" message is produced for an unknown identifier on a previously trusted key as the applcation does not retrieve enough information from the GnuPG API. NOTE: third parties dispute the significance of this issue, and disput...

openSUSE: Security Advisory for shim (openSUSE-SU-2021:0598-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2021:0598-1 Security update for shim

This update for shim fixes the following issues: - Updated openSUSE x86 signature - Avoid the error message during linux system boot boo1184454 - Prevent the build id being added to the binary. That can cause issues with the signature Update to 15.4 boo1182057 + Rename the SBAT variable and fix t...

The vulnerability of Thunderbird email client, related to incorrect verification of the OpenPGP cryptographic signature, allows attackers to gain access to protected information.

The vulnerability of the Thunderbird email client is related to an improper verification of the OpenPGP cryptographic signature. Exploiting this vulnerability could allow a remote attacker to gain access to protected information...

Important: nettle

Issue Overview: A flaw was found in Nettle, where several Nettle signature verification functions GOST DSA, EDDSA & ECDSA result in the Elliptic Curve Cryptography point ECC multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an...

The vulnerability of Thunderbird email client, related to incorrect verification of the OpenPGP cryptographic signature, allows attackers to gain access to protected information.

The vulnerability of the Thunderbird email client is related to an improper verification of the OpenPGP cryptographic signature. Exploiting this vulnerability could allow a remote attacker to gain access to protected information...