Important: libksba

Issue Overview: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE-2022-47629 Affected Packages: libksba Issue Correction: Run yum update libksba or yum update --advisory ALAS-2023-1752 to update your system. New Packages: i686: ...

USN-6138-1 libssh vulnerabilities

Philip Turnbull discovered that libssh incorrectly handled rekeying with algorithm guessing. A remote attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2023-1667 Kevin Backhouse discovered that libssh incorrectly...

Design/Logic Flaw

Certificate OCSP revocation status was not checked when verifying S/Mime signatures. Mail signed with a revoked certificate would be displayed as having a valid signature. Thunderbird versions from 68 to 102.7.0 were affected by this bug. This vulnerability affects Thunderbird 102.7.1...

Signature Validation Bypass

djangoses is vulnerable to Signature Validation Bypass. The vulnerability exists in utils.py due to a lack of validation in AWS certificates because an attacker can specify arbitrary public certificates...

CVE-2023-2987

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wapdxopconfigset' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the...

CVE-2023-2987

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wapdxopconfigset' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the...

Authorization

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wapdxopconfigset' function in versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to the plugin to change the...

CVE-2023-2987 Wordapp <= 1.6.0 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature

The Wordapp plugin for WordPress is vulnerable to authorization bypass due to an use of insufficiently unique cryptographic signature on the 'wapdxopconfigset' function in versions up to, and including, 1.6.0. This makes it possible for unauthenticated attackers to the plugin to change the...

CVE-2023-2987

The Wordapp WordPress plugin (Wordapp) is vulnerable to an authorization bypass due to an insufficiently unique cryptographic signature in the wa_pdx_op_config_set function, affecting versions up to and including 1.5.0. This allows unauthenticated attackers to modify the plugin’s validation_token...

PT-2023-22457 · WordPress · Wordapp

Name of the Vulnerable Software and Affected Versions: Wordapp plugin for WordPress versions up to, and including, 1.5.0 Description: The issue is related to an authorization bypass due to the use of an insufficiently unique cryptographic signature on the wa pdx op config set function. This allow...

WordPress Plugin Wordapp 数据伪造问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

GHSA-JQVR-J2VG-GJRV Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Signature validation bypass in github.com/moov-io/signedxml

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Input validation

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

Wordapp <= 1.5.0 - Authorization Bypass via Insufficiently Unique Cryptographic Signature

The plugin uses an insufficiently unique cryptographic signature in the wapdxopconfigset function, which could allow an unauthenticated attacker to change the validationtoken in the plugin config, providing access to the plugin's remote control functionalities, such as creating an admin access UR...

Moov signedxml 数据伪造问题漏洞

signedxml is moov open source a pure go library for processing signed XML documents . Moov signedxml version 1.0.0 and earlier versions of a security vulnerability , the vulnerability stems from parsing the original XML may lead to parsing the canonicalized XML with a different output , an attack...

CVE-2023-34205

In Moov signedxml through 1.0.0, parsing the raw XML as received can result in different output than parsing the canonicalized XML. Thus, signature validation can be bypassed via a Signature Wrapping attack aka XSW...

PT-2023-24736 · Moov · Signedxml

Name of the Vulnerable Software and Affected Versions: Moov signedxml versions 1.0.0 and earlier Description: The issue arises from the difference in output when parsing raw XML versus canonicalized XML, allowing an attacker to bypass signature validation through a Signature Wrapping attack. This...