15260 matches found
PT-2025-22082
Name of the Vulnerable Software and Affected Versions OpenPGP.js versions 5.0.1 through 5.11.2 OpenPGP.js versions 6.0.0 through 6.1.0 Description A maliciously modified message can be passed to either openpgp.verify or openpgp.decrypt, causing these functions to return a valid signature...
OpenPGP.js 数据伪造问题漏洞
OpenPGP.js is an open source OpenPGP encryption algorithm library implemented in JavaScript by OpenPGP.js Open Source. A data forgery issue vulnerability exists in OpenPGP.js versions prior to 5.11.3 and 6.1.1, which stems from a maliciously modified message that could result in signature...
PT-2025-22111
Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.10.0 Description A Signature Wrapping attack has been found in samlify, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provide...
Security Bulletin: Vulnerability in OpenSSL (CVE-2024-13176) affects PowerVM
Summary OpenSSL is used by PowerVM to support virtual TPM operations. This bulletin provides a remediation for the impacted vulnerability, CVE-2024-13176 by upgrading PowerVM and thus addressing the exposure to the openssl vulnerability. Vulnerability Details CVEID:CVE-2024-13176 DESCRIPTION: Iss...
OESA-2025-1522 gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: In GnuP...
OESA-2025-1521 gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: In GnuP...
OESA-2025-1523 gnupg2 security update
GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 also known as PGP. GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. Security Fixes: In GnuP...
CVE-2025-3757
Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation due to insufficient validation in the MsgCommitPubRandList handler, combined with a lack of domain separation in signed messages. An attacker can store an invalid PubRand commitment by crafting the message parameters ...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation due to insufficient validation in the MsgCommitPubRandList handler, combined with a lack of domain separation in signed messages. An attacker can store an invalid PubRand commitment by crafting the message parameters ...
GHSA-7MM3-VFG8-7RG6 Babylon Finality Provider `MsgCommitPubRandList` replay attack
Summary A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce that the submitted Commitment field is 32...
SUSE-SU-2025:0613-2 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation bsc1236136. Other bugfixes: - Non approved PBKDF parameters wrongly resulting as approved bsc1236771...
SUSE-SU-2025:0613-3 Security update for openssl-1_1
This update for openssl-11 fixes the following issues: - CVE-2024-13176: Fixed timing side-channel in the ECDSA signature computation bsc1236136. Other bugfixes: - Non approved PBKDF parameters wrongly resulting as approved bsc1236771...
Signature Verification Bypass
github.com/openpubkey/opkssh is vulnerable to Signature Verification Bypass. The vulnerability is due to improper verification of JWS structure and signature data caused by incorrect implementation of the JWS signature verification logic, allows an attacker to bypass authentication mechanisms in...
Alibaba Cloud Linux 3 : 0151: gnupg2 (ALINUX3-SA-2023:0151)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0151 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-34903: GnuPG through 2.3.6, in unusual...
Microsoft Azure Functions Data Forgery Issue Vulnerability
Microsoft Azure Functions is a hosted Platform-as-a-Service PaaS provider from Microsoft Corporation USA that provides event-driven and scheduled compute resources for Azure cloud services. Microsoft Azure Functions has a data forgery issue vulnerability that stems from improper cryptographic...
Alibaba Cloud Linux 3 : 0081: nss (ALINUX3-SA-2021:0081)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2021:0081 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-43527: NSS Network Security Services...
OpenPubkey Vulnerable to Authentication Bypass
Impact Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. Patches Upgrade to v0.10.0 or greater. This vulnerability is not present in versions of OpenPubkey after v0.9.0. References CVE-2025-3757...
