GHSA-PWFW-MGFJ-7G3G ecdsa Denial of Service vulnerability in signature verification and signature malleability

possible DoS in signature verification and signature malleability Impact Code using VerifyingKey.verify and VerifyingKey.verifydigest may receive exceptions other than the documented BadSignatureError when signatures are malformed. If those other exceptions are not caught, they may lead to progra...

ecdsa Denial of Service vulnerability in signature verification and signature malleability

possible DoS in signature verification and signature malleability Impact Code using VerifyingKey.verify and VerifyingKey.verifydigest may receive exceptions other than the documented BadSignatureError when signatures are malformed. If those other exceptions are not caught, they may lead to progra...

CVE-2019-10181

It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox...

Cisco NX-OS Software Virtual Service Image Signature Bypass Vulnerability

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. The vulnerability allows an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device...

The vulnerability of NX-OS and Cisco IOS XE operating systems arises from errors during the verification of the electronic signature when installing an Open Virtual Appliance (OVA) image. This vulnerability allows a perpetrator to install malware onto a vulnerable device.

The vulnerability of NX-OS and Cisco IOS XE operating systems is related to errors during the verification of the electronic signature when installing an Open Virtual Appliance OVA image. Exploiting this vulnerability allows a perpetrator to install malware onto a vulnerable device...

Cisco Patches 13 High-Severity Router and Switch Bugs

Cisco Systems released patches for 29 bugs Wednesday that addressed flaws in a wide range of its products including routers and switches running the IOS XE networking software. Thirteen of the vulnerabilities revealed are rated high severity. The bulk of the high-severity vulnerabilities are tied...

CVE-2019-12662

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper...

CVE-2019-12662

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper...

Design/Logic Flaw

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper...

CVE-2019-12662

CVE-2019-12662 affects Cisco NX-OS Software and Cisco IOS XE Software. The issue is improper signature verification during installation of an Open Virtual Appliance (OVA) image, allowing an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a maliciou...

CVE-2019-12662 Cisco NX-OS and IOS XE Software Virtual Service Image Signature Bypass Vulnerability

A vulnerability in Cisco NX-OS Software and Cisco IOS XE Software could allow an authenticated, local attacker with valid administrator or privilege level 15 credentials to load a virtual service image and bypass signature verification on an affected device. The vulnerability is due to improper...

CVE-2019-12649 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected...

GHSA-4FGQ-GQ9G-3RW7 Improper Verification of Cryptographic Signature in keycloak

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users...

EulerOS 2.0 SP5 : icedtea-web (EulerOS-SA-2019-1905)

According to the versions of the icedtea-web package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that executable code could be injected in a JAR file without compromising the signature verification. An attacker could use thi...

HPSBPI06327 rev. 1 - Execution of Arbitrary Code for HP LaserJet, PageWide, OfficeJet Enterprise, and LaserJet Managed Printers

Potential Security Impact Execution of arbitrary code VULNERABILITY SUMMARY Solution application signature checking may allow potential execution of arbitrary code. RESOLUTION Perform the following steps to help mitigate the vulnerability. 1. Update firmware for impacted printers as indicated in...

Debian: Security Advisory (DLA-1914-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1914-1 : icedtea-web security update

Several security vulnerabilities were found in icedtea-web, an implementation of the Java Network Launching Protocol JNLP. CVE-2019-10181 It was found that in icedtea-web executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this fl...

Updated icedtea-web packages fix security vulnerabilities

Updated icedtea-web packages fix security vulnerabilities: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The cod...

Cisco NX-OS Software Arbitrary File Overwrite Vulnerability

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software. An authenticated, local attacker can exploit the vulnerability to overwrite any file on the file system...

CentOS 7 : ruby (CESA-2019:2028)

An update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...