15466 matches found
CVE-2022-1520
CVE-2022-1520 affects Thunderbird prior to 91.9. The issue is an incorrect encryption/signature status display when viewing an email A with an attached B (encrypted/digitally signed). After opening B, returning to A may cause A to show B’s security status. This is a client-side UI discrepancy, no...
jsonwebtoken 数据伪造问题漏洞
jsonwebtoken is Auth0 open source implementation of a JSON Web token . jsonwebtoken version 8.5.1 and earlier versions of data forgery vulnerability , the vulnerability stems from the default use of the "none" algorithm for signature verification , jwt.verify function in the lack of algorithm...
CVE-2022-1834
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...
CVE-2022-2226
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...
CVE-2021-4126
The CVE-2021-4126 issue affects Thunderbird: when receiving an OpenPGP/MIME signed email with an outer MIME layer (e.g., mailing list footer), Thunderbird incorrectly treated inner content as signed. The root cause is that the displayed signature status was based on the inner part; since 91.4.1, ...
CVE-2021-4126
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...
CVE-2022-2226
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...
CVE-2022-2226
CVE-2022-2226 describes a vulnerability in Mozilla Thunderbird where an OpenPGP signature includes the signature date, which may differ from the email display date. If the dates don’t match, Thunderbird could still accept the signature; a replay attack (resenting an old email later) could mislead...
CVE-2022-1834
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...
PT-2022-16059
Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The jsonwebtoken library could be misconfigured to use legacy, insecure key types for signature verification. For example, DSA keys could be used with the RS256 algorithm. Users are affected if they use...
CVE-2021-4126
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the addition...
CVE-2022-26387
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...
CVE-2022-26387
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...
CVE-2022-1834
When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown...
CVE-2022-26387
The CVE-2022-26387 issue is a Mozilla add-on verification weakness. A time-of-check/time-of-use (TOCTOU) bug could allow the add-on file to be altered after Firefox/Thunderbird signatures were checked but before user confirmation, leaving the user exposed. Affected products and versions per conne...
PT-2022-16061
Name of the Vulnerable Software and Affected Versions jsonwebtoken versions =8.5.1 Description The issue arises from the lack of algorithm definition in the jwt.verify function, leading to a signature validation bypass due to defaulting to the none algorithm for signature verification. This occur...
CVE-2022-2226
An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an...
Signature mallebaility in underwritePriceForCollateral
Lines of code Vulnerability details Impact underwritePriceForCollateral has signature malleability as it doesn't check for a returned address of not 0. Value can be set to 0 oracleSigner Proof of Concept function underwritePriceForCollateralERC721 asset, PriceKind priceKind, OracleInfo memory...
PT-2022-28078 · Kyverno · Kyverno
Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.8.3 through 1.8.4 Description: An image signature validation bypass issue allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster...
