15369 matches found
lua-resty-jwt 安全漏洞
lua-resty-jwt is a library from the individual developer Christian Battaglia. A security vulnerability exists in lua-resty-jwt version 0.2.3, which originated from a vulnerability that allows an attacker to bypass all JWT parsing signature checks by crafting a JWT with an enc header with the valu...
CVE-2024-33531
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM...
PT-2024-25302
Name of the Vulnerable Software and Affected Versions lua-resty-jwt version 0.2.3 Description The issue allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM. This enables them to potentially access unauthorized resources or perfor...
CVE-2024-33531
cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM...
nodejs: vulnerable to timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding (Marvin)
A flaw was found in Node.js. The privateDecrypt API of the crypto library may allow a covert timing side-channel during PKCS1 v1.5 padding error handling. This issue revealed significant timing differences in decryption for valid and invalid ciphertexts, which may allow a remote attacker to decry...
The vulnerability of the dsaVerify() function in the Browserify-sign cryptographic function library allows a perpetrator to create signatures that can be successfully verified with any public key. This leads to an attack of signature forgery.
The vulnerability of the dsaVerify function in the Browserify-sign cryptographic functionality package is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows an attacker to generate signatures that can be successfully verified with any public key,...
OPENSUSE-SU-2024:0111-1 Security update for putty
This update for putty fixes the following issues: Update to release 0.81 Fix CVE-2024-31497: NIST P521 / ecdsa-sha2-nistp521 signatures are no longer generated with biased values of k. The previous bias compromises private keys...
ROS-20240418-08
A vulnerability in the Browserify-sign cryptographic functionality duplication package is related to the upper bound check in the dsaVerify function. Exploitation of the vulnerability could allow an attacker, acting remotely, to create signatures that can be successfully verified by any public ke...
CVE-2024-29950
The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack...
CVE-2023-0657
A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...
Broadcom Brocade SANnav 加密问题漏洞
Broadcom Brocade SANnav is a suite of SAN management platforms from Broadcom USA. A security vulnerability exists in Broadcom Brocade SANnav versions prior to v2.3.1, v2.3.0a, which stems from the FileTransfer class using the ssh-rsa signature scheme, which has a SHA-1 hash value, allowing an...
The class FileTransfer implemented uses the ssh-rsa signature scheme (CVE-2024-29950)
The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack...
Vulnerability fixed in Putty
Putty has fixed a vulnerability in Putty Client. The vulnerability in Putty is in how the ECDSA nonce is created when using NIST P-521. This makes possible for a malicious person to guess the nonce and use using the signed text to retrieve the private key. Putty is also used in the following...
The vulnerability in the implementation of the Secure Boot protocol for operating systems with security features allows a perpetrator to circumvent security restrictions.
The vulnerability in the implementation of the Secure Boot protocol for Windows operating systems is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a perpetrator to circumvent security restrictions...
The vulnerability of the ECDSA signature generation component in client software for various remote access protocols allows a hacker to intercept session sessions.
The vulnerability of the ECDSA signature generation component in client software for various remote access protocols, such as Putty, is related to the possibility of recovering the secret key. Exploiting this vulnerability allows a malicious actor to intercept sessions by recovering the secret ke...
PT-2024-6165 · Microsoft · Office Onenote
Name of the Vulnerable Software and Affected Versions: Microsoft OneNote version 16.83 Description: A library injection vulnerability exists in Microsoft OneNote for macOS. This issue is related to incorrect cryptographic signature verification, allowing a specially crafted library to leverage...
PT-2024-6166 · Microsoft · Office Word
Name of the Vulnerable Software and Affected Versions: Microsoft Word version 16.83 for macOS Description: A library injection vulnerability exists in Microsoft Word. A specially crafted library can leverage Word's access privileges, potentially leading to a permission bypass. A malicious...
UBUNTU-CVE-2024-31497
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant...
PT-2024-3222 · Brocade · Brocade Sannav
Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to the class FileTransfer in Brocade SANnav, which uses the ssh-rsa signature scheme with a SHA-1 hash. This could allow a remote,...
The vulnerability of the authentication library for exchanging identification data according to the SAML2 standard, related to improper verification of the cryptographic signature, allows a perpetrator to bypass the signature verification and gain access to protected information.
The vulnerability of the authentication library for exchanging identification data according to the SAML2 standard, implemented by PySAML2, is related to the XML signature encoding scheme used. This scheme does not verify whether the SAML document conforms to the XML schema. Exploiting this...