CVE-2018-1000539

Nov json-jwt version = 0.5.0 && 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted JSON Web Tokens that can result in Attacker can forge a authentication tag. This attack appear to be exploitable via network connectivity. Th...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM FlashSystem model V840 (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM® FlashSystem™ V840. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM API Management (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM API Management. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a ServerKeyExchange message...

pulp-consumer-client design flaws

pulp-consumer-client is a client for the Pulp platform codebase from the Pulp team. A design vulnerability exists in pulp-consumer-client versions 2.4.0 through 2.6.3, which stems from the program's failure to detect the server's TLS certificate signature. An attacker can exploit the vulnerabilit...

Updated libtomcrypt packages fix security vulnerability

It was discovered that the implementation of RSA signature verification in libtomcrypt is vulnerable to the Bleichenbacher signature attack. If an RSA key with exponent 3 is used it may be possible to forge a PKCS1 v1.5 signature signed by that key CVE-2016-6129...

py-rsa -- Bleichenbacher'06 signature forgery vulnerability

Filippo Valsorda reports: python-rsa is vulnerable to a straightforward variant of the Bleichenbacher'06 attack against RSA signature verification with low public exponent...

F5 Networks BIG-IP : GnuTLS RSA PKCS signature vulnerability (K17327)

GnuTLS before 3.1.0 does not verify that the RSA PKCS 1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors. CVE-2015-0282 C Tenable Network Security, Inc. The descriptive text and package check...

CVE-2015-3408

Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest...

Unspecified File Handling Signature Vulnerability in Module::Signature Module for Perl

Perl is a programming language. An unspecified security vulnerability exists in Module::Signature Module for Perl related to Test Phase, which could be exploited by a remote attacker to process an unsigned file as a signed file...

DEBIAN-CVE-2013-5645

Multiple cross-site scripting XSS vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in 1 new or 2 draft mode, related to compose.inc; and 3 might allow remote authenticated users to injec...

CVE-2013-2145

The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/...

MGASA-2013-0184 Updated perl-Module-Signature package fixes CVE-2013-2145

Arbitrary code execution vulnerability in Module::Signature before 0.72 CVE-2013-2145...

CVE-2012-2388

The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a 1 empty or 2 zeroed RSA signature, aka "RSA signature verification vulnerability."...

Fedora 16 : strongswan-4.6.4-1.fc16 (2012-8821)

RSA signature verification vulnerability CVE-2012-2388 Fix bug 821733 and update to new upstream version Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much ...

[SECURITY] [DSA 1849-1] New xml-security-c packages fix signature forgery

------------------------------------------------------------------------ Debian Security Advisory DSA-1849-1 [email protected] http://www.debian.org/security/ Florian Weimer August 02, 2009 http://www.debian.org/security/faq -...

CVE-2009-0217

The design of the W3C XML Signature Syntax and Processing XMLDsig recommendation, as implemented in products including 1 the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 2 the WebLogic Server component in BEA Product Suite 10.3, 10.0...

FreeBSD Security Advisory (FreeBSD-SA-09:02.openssl.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-09:02.openssl.asc SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2007-6364

Cross-site scripting XSS vulnerability in modificarPerfil.php in JLMForo System allows remote authenticated users to inject arbitrary web script or HTML via a signature...

CVE-2006-0364

This entry concerns CVE-2006-0364, a cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB). The issue arises when an attacker can inject arbitrary script/HTML via a signature that contains a JavaScript URI in the SRC attribute of an IMG element, where the URI uses SGML numeric charac...