PT-2022-23914 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for cross-site scripting XSS via XHTML CDATA for a snippet. This can be demonstrated by the onerror attribute of an IMG element within an e-mail signature. Recommendations...

The vulnerability of the Ethernet interfaces of Tofino Xenon Security Appliance, Tofino Argon Security Appliance, and EAGLE 20 Tofino allows for bypassing the cryptographic signature verification on a USB drive. This enables a perpetrator to load any arbitrary image of the embedded software onto the device.

The vulnerability of the Tofino Xenon Security Appliance, Tofino Argon Security Appliance, and EAGLE 20 Tofino lies in bypassing the cryptographic signature verification on a USB drive. Exploiting this vulnerability allows a malicious actor to download any arbitrary image of the embedded software...

CVE-2022-23539

A flaw was found in the jsonwebtoken package. The affected versions of the jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm...

Unrestricted Key Type

jsonwebtoken uses unrestricted key type. A remote attacker is able to bypass signature verification if the library is misconfigured so that legacy, insecure key types are used for the verification. The user is affected if the library uses an algorithm and a key type other than a combination liste...

Signature Validation Bypass

jsonwebtoken is vulnerable to signature validation bypass. The lack of algorithm definition in the jwt.verify function leads to signature validation bypass due to defaulting to the none algorithm for signature verification, which allows an attacker to bypass the verification mechanism...

CVE-2022-47633

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations a...

jsonwebtoken 加密问题漏洞

jsonwebtoken is a JSON Web token implementation from Auth0 Open Source. A cryptographic issue vulnerability exists in jsonwebtoken version 8.5.1 and prior versions, which stems from old, insecure key types used for signature verification...

CVE-2022-47633

This CVE refers to Kyverno image-signature validation bypass in Kyverno releases 1.8.3/1.8.4, which could allow a malicious image registry or a man-in-the-middle to inject unsigned container images into a protected Kubernetes cluster. The issue is fixed in 1.8.5; mitigations exist for impacted re...

CVE-2022-23539

CVE-2022-23539 affects jsonwebtoken versions ≤ 8.5.1, where misconfiguration could allow legacy insecure key types to be used for signature verification (e.g., DSA with RS256). The issue has been fixed in v9.0.0, which validates asymmetric key type/algorithm combinations. After upgrading, if you ...

CVE-2022-23539 jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...

CVE-2022-23539 jsonwebtoken unrestricted key type could lead to legacy keys usage

Versions =8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the...

CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...

DEBIAN-CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...

CVE-2022-2226

An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...

CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

DEBIAN-CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

CVE-2022-1520

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A...

CVE-2022-1834

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...

DEBIAN-CVE-2022-1834

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...

CVE-2022-1834

When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...