Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2019-1546)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for icedtea-web (EulerOS-SA-2019-1905)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-4245-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4245-1: PySAML2 vulnerability

It was discovered that PySAML2 incorrectly handled certain SAML files. An attacker could possibly use this issue to bypass signature verification with arbitrary data...

USN-4245-1 python-pysaml2 vulnerability

It was discovered that PySAML2 incorrectly handled certain SAML files. An attacker could possibly use this issue to bypass signature verification with arbitrary data...

XML Signature Wrapping

pySAML2 is vulnerable to XML signature wrapping. The signature validation function checksignature does not properly validates the signature in a SAML document, allowing an attacker to bypass signature verification with arbitrary data...

UBUNTU-CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

CVE-2020-5390

PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping XSW. The signature information and the node/object that is signed can be in different places and thus the signature...

PT-2020-5164

Name of the Vulnerable Software and Affected Versions PySAML2 versions prior to 5.0.0 Description The issue is related to incorrect verification of cryptographic signatures in SAML2 documents, allowing a remote attacker to bypass signature checks and access protected information. This is due to t...

CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

The vulnerabilities of McAfee Total Protection (MTP), McAfee Anti-Virus Plus (AVP), and McAfee Internet Security (MIS) software lie in their shortcomings regarding the loading of external files and the verification of their digital signatures. This allows attackers to exploit these vulnerabilities to enhance their privileges and execute malicious code.

The vulnerabilities of McAfee Total Protection MTP, McAfee Anti-Virus Plus AVP, and McAfee Internet Security MIS are related to deficiencies in loading external files from inappropriate directories and verifying their digital signatures. Exploiting these vulnerabilities can allow attackers to...

The vulnerability of the Omnibox component in the Google Chrome browser allows attackers to perform spoofing attacks.

The vulnerability of the Omnibox component in Google Chrome relates to deficiencies in the mechanism for verifying digital signatures. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks using a specially created domain name...

Unspecified vulnerability in NVIDIA GeForce Experience local service provider component

NVIDIA Windows GPU Display Driver and NVIDIA GeForce Experience are both products of NVIDIA Corporation.NVIDIA Windows GPU Display Driver is a graphics processor GPU driver for the Windows platform. NVIDIA GeForce Experience is a set of automatic graphics card update tools. The product can...

EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to caus...

Signature Verification Bypass

robrichards/xmlseclibs is vulnerable to signature verification bypass. The implementation of the SAML 2.0 protocol allows for the circumvention of XML signature verification on SAML messages due to the failure to ensure only a single SignedInfo element exists within the signature...

Debian DSA-4560-1 : simplesamlphp - security update

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DLA-1983-1 : simplesamlphp security update

It was discovered that in SimpleSAMLphp, an implementation of the SAML 2.0 protocol, it was possible to circumvent XML signature verification on SAML messages. For Debian 8 'Jessie', this problem has been fixed in version 1.13.1-2+deb8u3. We recommend that you upgrade your simplesamlphp packages...

[SECURITY] Fedora 31 Update: python-ecdsa-0.13.3-1.fc31

This is an easy-to-use implementation of ECDSA cryptography Elliptic Curve Digital Signature Algorithm, implemented purely in Python, released under the MIT license. With this library, you can quickly create keypairs signing key and verifying key, sign messages, and verify the signatures. The key...

CVE-2019-14859

A flaw was found in python-ecdsa, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false...