99 matches found
SUSE-SU-2025:0345-1 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation bsc1236136...
MGASA-2025-0025 Updated openssl packages fix security vulnerability
Timing side-channel in ECDSA signature computation. CVE-2024-13176...
CVE-2025-23369
An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed signature spoofing for unauthorized internal users. Instances not utilizing SAML single sign-on or where the attacker is not already an existing user were not impacted. This...
CVE-2023-28804 Linux ZCC allows unsigned updates, allowing elevated Code Execution
An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105...
K17327: GnuTLS RSA PKCS signature vulnerability CVE-2015-0282
Security Advisory Description GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors. CVE-2015-0282 Impact This vulnerability may allow remot...
Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model 840 (CVE-2015-7575)
Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM® FlashSystem™ 840. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...
CVE-2021-43074
CVE-2021-43074 is an explicit Fortinet issue: an improper verification of cryptographic signatures (CWE-347) affects FortiWeb and related Fortinet products, allowing an attacker who intercepts admin cookies to decrypt portions of the administrative session cookie. Affected products and versions i...
SUSE CVE-2009-1189
The dbusvalidatesignaturewithreason function dbus-marshal-validate.c in D-Bus aka DBus before 1.2.14 uses incorrect logic to validate a basic type, which allows remote attackers to spoof a signature via a crafted key. NOTE: this is due to an incorrect fix for CVE-2008-3834...
SUSE CVE-2018-18508
In Network Security Services NSS before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of Service...
Muon 安全特征问题漏洞
Muon is a minimalist private self-destructing file-hosting web server written in Clojure. A security signature issue vulnerability exists in Muon version 0.1.1. An attacker could exploit this vulnerability to cause a random value insufficiency...
FreeBSD : dendrite -- Signature checks not applied to some retrieved missing events (4ebaa983-3299-11ed-95f8-901b0e9408dc)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4ebaa983-3299-11ed-95f8-901b0e9408dc advisory. - Dendrite team reports: Events retrieved from a remote homeserver using /getmissingevents did not have...
Voting signature malleability of EVM's ecrecover in castVoteBySig
Lines of code Vulnerability details Proof of Concept EVM's ecrecover is susceptible to signature malleability which allows replay attacks, but that is mitigated here by doing receipt.hasVoted = true;. However, if any of the application logic changes, it might make signature malleability a risk fo...
CVE-2022-35961 ECDSA signature malleability in OpenZeppelin Contracts
OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...
JetBrains Ktor Native 安全特征问题特征问题漏洞
JetBrains Ktor Native is an asynchronous framework for creating microservices, web applications, and more from the Czech company JetBrains. A security signature issue vulnerability exists in JetBrains Ktor Native versions prior to 2.0.1, which stems from the fact that SHA1 can return the same val...
Google Chromium 安全特征问题特征问题漏洞
Google Chromium is an open source web browser from Google, Inc. Google Chromium suffers from a security signature issue vulnerability that could lead to the execution of arbitrary code, denial of service, or information disclosure...
CVE-2021-30066
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...
Moderate: lasso security and enhancement update
The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages. Security Fixes: lasso: XML...
lasso security and enhancement update
An update is available for lasso. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The lasso packages provide the Lasso library that implements the Liberty Allian...
Ubuntu 18.04 LTS / 20.04 LTS : PySAML2 vulnerability (USN-5066-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5066-1 advisory. Brian Wolff discovered that PySAML2 incorrectly validated cryptographic signatures. A remote attacker could possibly use this issue to alter SAML...
