CVE-2022-47549

The vulnerability CVE-2022-47549 affects OP-TEE within TrustedFirmware (OP-TEE) prior to version 3.20. The root cause is an unprotected memory-access operation in optee_os that enables a physically proximate attacker to bypass signature verification and install malicious trusted applications thro...

CVE-2022-47549

An unprotected memory-access operation in opteeos in TrustedFirmware Open Portable Trusted Execution Environment OP-TEE before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections...

_priceData.price is not verified in _limitClose

Lines of code Vulnerability details Impact In the function limitClose from the TradingExtension contract the priceData.price is not verified with the getVerifiedPrice function instead its value is directly used, and because the the getVerifiedPrice internally calls the function...

CVE-2022-23507

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...

Design/Logic Flaw

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...

CVE-2022-23507 Light client verification not taking into account chain ID

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...

CVE-2022-23507

The CVE concerns Tendermint’s light-client verification prior to version 0.28.0, where the light client does not verify that the trusted and untrusted chain IDs match during header verification. This can allow a header from an untrusted chain that passes other checks (e.g., overlapping validator ...

CVE-2022-23507 Light client verification not taking into account chain ID

Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform ligh...

Zoom Client for Meetings < 5.5.4 Vulnerability (ZSB-21016)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.5.4. It is, therefore, affected by a vulnerability as referenced in the ZSB-21016 advisory. - The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files...

Tendermint 数据伪造问题漏洞

Tendermint is a Byzantine Fault Tolerant BFT style middleware from Tendermint Corporation. A data forgery issue vulnerability exists in versions of Tendermint prior to 0.28.0, which stems from a potential attack that includes verification via incorrect cryptographic signatures and affects anyone...

golang: crash in a golang.org/x/crypto/ssh server

A broken cryptographic algorithm flaw was found in golang.org/x/crypto/ssh. This issue causes a client to fail authentication with RSA keys to servers that reject signature algorithms based on SHA-2, enabling an attacker to crash the server, resulting in a loss of availability...

PT-2022-6357 · Dell · Alienware Update +2

Name of the Vulnerable Software and Affected Versions: Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 Description: The issue is related to an improper verification of cryptographic signature in the get applicable driver component. This could allow a local malicious...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2022-2788)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5689-1: Perl vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Canonical Ubuntu 22.04 Description It was discovered that Perl incorrectly handled certain signature verification. An remote attacker could possibly use this issue to bypass signature...

PT-2022-16025

Name of the Vulnerable Software and Affected Versions Certifi versions prior to 2022.12.07 Description The issue is related to the presence of TrustCor's root certificates in the list of root certificates, which has been removed due to TrustCor's involvement in producing spyware. This removal is...

FreeBSD : rpm4 -- Multiple Vulnerabilities (0c52abde-717b-11ed-98ca-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0c52abde-717b-11ed-98ca-40b034429ecf advisory. - There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a...

Open-Xchange OX App Suite 跨站脚本漏洞

Open-Xchange OX App Suite is an e-mail and productivity suite client software from the German company Open-Xchange. A security vulnerability exists in Open-Xchange OX App Suite version 7.10.6 and earlier, which stems from the fact that certain content such as E-Mail signatures are stored using a...

Cross-site scripting vulnerability in WordPress Simple:Press plugin

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Simple:Pre...

CVE-2022-4028

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes...

CVE-2022-4028 Simple:Press <= 6.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Signatures

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes...