Zoom Client for Meetings < 5.13.5 Vulnerability (ZSB-23010)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.13.5. It is, therefore, affected by a vulnerability as referenced in the ZSB-23010 advisory. - Zoom for Windows clients prior to 5.13.5 contain an improper verification of cryptographic signature vulnerability. A...

Zoom Client 数据伪造问题漏洞

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A security vulnerability exists in Zoom for Windows clients versions prior to 5.13.5 that stems from incorrect cryptographic signature verification. An attacker can exploit this vulnerability to...

Timing Attack

saleor is vulnerable to a Timing Attack. The vulnerability exists due the validatehmacsignature function which has a non constant time that can allow an attacker to infer the secret key or forge fake events...

Huawei EulerOS: Security Advisory for rpm (EulerOS-SA-2023-2230)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2023-2199)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GO-2023-1826 Signature validation bypass in github.com/moov-io/signedxml

Signature validation canonicalizes the input XML document before validating the signature. Parsing the uncanonicalized and canonicalized forms can produce different results. An attacker can exploit this variation to bypass signature validation. Users of signature validation must only parse the...

Denial Of Service (DoS)

github.com/notaryproject/notation is vulnerable to Denial of Service DoS attacks. The vulnerability is due to the maxSignatureAttempts in verify.go, which allows an attacker to cause denial of service by submitting endless signature data...

Denial Of Service (DoS)

github.com/notaryproject/notation is vulnerable to Denial of Service DoS attacks. The vulnerability is due to a lack of artifact signature count checks, which allows an attacker to add a high number of signatures to an artifact, resulting in denial of service when running notation verify...

The owner is a single point of failure and a centralization risk

Lines of code Vulnerability details Impact Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure. A single private key may be taken in a hack, or the sole holder of the key may become unable to retrieve the key when necessary. Similar...

EulerOS 2.0 SP5 : perl (EulerOS-SA-2023-2163)

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 Note that Tenable Network Security has extracted the preceding description block...

EulerOS 2.0 SP5 : libksba (EulerOS-SA-2023-2155)

According to the versions of the libksba package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Note that Tenable Network Securit...

Lack of Event Signature Verification

Lines of code Vulnerability details Impact The functions submitExchangeRateData, submitSDPrice, and submitValidatorStats emit events without verifying the signature of the calling contract. Malicious contracts can exploit this by emitting events with misleading information, potentially deceiving...

Huawei EulerOS: Security Advisory for perl (EulerOS-SA-2023-2163)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Centralization risk for trusted owners

Lines of code Vulnerability details Description: Contracts have owners that have privileged rights to perform admin tasks. These owners need to be trusted to not perform malicious updates or drain funds. Having a single Externally Owned Account EOA as the sole owner represents a significant...

Huawei EulerOS: Security Advisory for libksba (EulerOS-SA-2023-2155)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The owner is a single point of failure and a centralization risk (06 Instances)

Lines of code Vulnerability details Impact Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure. A single private key may be taken in a hack, or the sole holder of the key may become unable to retrieve the key when necessary. Tools Used...

Signature Verification Bypass

github.com/moov-io/signedxml is vulnerable to Signature Verification Bypass. The vulnerability exists because parsing the raw XML as received can result in different output than parsing the canonicalized XML in the Validate function of validator.go, which allows an attacker to bypass signature...

golang: crash in a golang.org/x/crypto/ssh server

A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability...

Huawei EulerOS: Security Advisory for libksba (EulerOS-SA-2023-2055)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Veeam Agent for Microsoft Windows Update Fails with "The digital signature of the downloaded update file is invalid"

Challenge The integrated Veeam Agent for Microsoft Windows Update check displays the error: The digital signature of the downloaded update file is invalid. Most likely, it got corrupted. Please, download the update again. An alternate message is a warning stating: Version is available but cannot ...