Improper Verification Of Cryptographic Signature

github.com/minio/minio is vulnerable to authorization bypass. The vulnerability is due to improper signature verification due to the ability to use arbitrary secrets to upload objects if the attacker has prior WRITE permissions and access to the access key and bucket name...

Medium: nerdctl

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing...

CVE-2025-27813

MSI Center before 2.0.52.0 has Missing PE Signature Validation...

SUSE CVE-2012-4912

Cross-site scripting XSS vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to inject arbitrary web script or HTML via a crafted signature in an HTML e-mail message...

SUSE CVE-2025-31489

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

CVE-2025-27813

MSI Center before 2.0.52.0 has Missing PE Signature Validation...

Micro-Star MSI Center 安全漏洞

Micro-Star MSI Center is a monitoring and management platform from Micro-Star China. You can find all your favorite features such as Game Mode or Smart Priority in the Feature Set page. A security vulnerability exists in Micro-Star MSI Center versions prior to 2.0.52.0, which stems from a lack of...

CVE-2025-27813

CVE-2025-27813 affects MSI Center prior to 2.0.52.0. The root cause is Missing PE Signature Validation, leading to potential tampering of PE-signature verified binaries. The CVSS 3.1 score is 8.1 (HIGH) with LOCAL attack vector, high attack complexity, no privileges required, and impact to confid...

The vulnerability of the implementation of the AWS4-HMAC-SHA256 algorithm in the cross-platform FTP server CrushFTP allows a hacker to bypass security restrictions, gain access to the administrator account, and execute arbitrary commands.

The vulnerability of the AWS4-HMAC-SHA256 algorithm implementation in the cross-platform FTP server CrushFTP relates to the bypassing of authentication by using the default crushadmin account. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions, gain access ...

PT-2025-15978 · Msi · Msi Center

Name of the Vulnerable Software and Affected Versions: MSI Center versions prior to 2.0.52.0 Description: The issue concerns missing PE signature validation. Recommendations: For versions prior to 2.0.52.0, update to version 2.0.52.0 or later to resolve the issue...

CVE-2025-27813

MSI Center before 2.0.52.0 has Missing PE Signature Validation...

CVE-2025-27813

MSI Center before 2.0.52.0 has Missing PE Signature Validation...

GO-2025-3594 MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio

MinIO performs incomplete signature validation for unsigned-trailer uploads in github.com/minio/minio...

(Pwn2Own) Samsung Galaxy S24 Smart Switch Agent Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S24. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Smart Switc...

The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto, related to improper verification of cryptographic signatures, allows attackers to escalate their privileges.

The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

PT-2026-22852

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One mac agent affected versions not specified Description A time-of-check time-of-use TOCTOU issue exists in the iCore service signature verification. A TOCTOU is a race condition where a system checks a condition such as a...

GHSA-WG47-6JQ2-Q2HH MinIO performs incomplete signature validation for unsigned-trailer uploads

Impact This is a high priority vulnerability and users must upgrade ASAP. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket, Prior...

MinIO performs incomplete signature validation for unsigned-trailer uploads

Impact This is a high priority vulnerability and users must upgrade ASAP. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on the bucket, Prior...

CVE-2025-31489

A flaw was found in the Minio package. The signature component of the authorization may be invalid, which would mean that, as a client, you can use any arbitrary secret to upload objects, given the user already has prior WRITE permissions on the bucket. Prior knowledge of the access key and bucke...

CVE-2025-31489

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...