PT-2022-6534 · Schneider Electric · Ecostruxure Operator Terminal Expert +1

Name of the Vulnerable Software and Affected Versions: EcoStruxure Operator Terminal Expert versions 3.3 Hotfix 1 or prior Pro-face BLUE versions 3.3 Hotfix 1 or prior Description: A vulnerability exists that allows adversaries with local user privileges to load a malicious DLL, which could lead ...

Multichain signature reuse risk when use the signature to grant allowance permission in GraphTokenUpgradeable.sol

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The GraphTokenUpgradeable support the usage of offline signature to approve token spending. However, there is Multichain signature reuse risk when user signing the signature, the attacker can take the...

Possible loss of assets for seller through cross-contract re-entrancy

Lines of code Vulnerability details Impact BlurExchange.execute applies a reentrancyGuard modifier, however does not apply the Check-Effect-Interact pattern since cancelledOrFilledsellHash and cancelledOrFilledbuyHash are set to true after the transfers. This presents the risk of a cross-contract...

Signature malleability

Lines of code Vulnerability details Impact Signature malleability allows the user to reuse the same signature twice. Which may cause order to be executed twice. Proof of Concept function recover bytes32 digest, uint8 v, bytes32 r, bytes32 s internal pure returns address requirev == 27 || v == 28,...

BlurExchange#_validateOracleAuthorization does not work as intended for bulk orders

Lines of code Vulnerability details Impact Bulk orders are not correctly signed and don't work as intended Proof of Concept BlurExchange.solL386-L392 else if signatureVersion == SignatureVersion.Bulk / If the signature was a bulk listing the merkle path musted be unpacked before the oracle...

Buyer can receive chargeback from fees.

Lines of code Vulnerability details Impact Since there is no check on who the fees.recipient is in the sell order, the buyer could be the fees recipient, with some additional signature malleability to pass the signature validation, the buyer would receive fees, thus pay less for the NFT. Proof of...

Huawei EulerOS: Security Advisory for gnupg2 (EulerOS-SA-2022-2460)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 3.0.6.0 : perl-CPAN (EulerOS-SA-2022-2581)

According to the versions of the perl-CPAN package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - CPAN 2.28 allows Signature Verification Bypass. CVE-2020-16156 Note that Tenable Network Security has extracted the preceding...

EulerOS 2.0 SP8 : gnupg2 (EulerOS-SA-2022-2460)

According to the versions of the gnupg2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints...

Improper Verification Of Cryptographic Signatures

sylabs sif is vulnerable to a lack of cryptographic signature validations. The vulnerability exists due to the package not verifying the hash algorithm used is cryptographically secure when verifying digital signatures allowing an attacker to perform unauthorized actions...

The vulnerability of the software update function of Cisco Enterprise NFV Infrastructure Software (NFVIS) allows a attacker to load any file onto a vulnerable device.

The vulnerability of the Cisco Enterprise NFV Infrastructure Software’s software update function NFVIS is related to errors during file signature verification. Exploiting this vulnerability could allow a attacker to load any file onto a vulnerable device...

SIF's Digital Signature Hash Algorithms Not Validated

Impact The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. Patches A patch is available in version = v2.8.1 of the module. Users are encouraged to upgrade. The patch is commit...

GHSA-M5M3-46GJ-WCH8 SIF's Digital Signature Hash Algorithms Not Validated

Impact The github.com/sylabs/sif/v2/pkg/integrity package does not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. Patches A patch is available in version = v2.8.1 of the module. Users are encouraged to upgrade. The patch is commit...

UBUNTU-CVE-2022-39237

syslabs/sif is the Singularity Image Format SIF reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. A patch is available in version =...

USN-5661-1 libreoffice vulnerabilities

It was discovered that LibreOffice incorrectly validated macro signatures. If a user were tricked into opening a specially crafted document, a remote attacker could possibly use this issue to execute arbitrary macros. CVE-2022-26305 It was discovered that Libreoffice incorrectly handled encryptin...

node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery

A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature...

node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery

A flaw was found in the node-forge package. This signature verification leniency allows an attacker to forge a signature...

node-forge: Signature verification leniency in checking `DigestInfo` structure

A flaw was found in the node-forge library when verifying the signature on the ASN.1 structure in RSA PKCS1 v1.5. This flaw allows an attacker to obtain successful verification for invalid DigestInfo structure, affecting the integrity of the attacked resource...

CVE-2022-39237 Digital Signature Hash Algorithms Not Validated in sylabs/sif

syslabs/sif is the Singularity Image Format SIF reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithms used are cryptographically secure when verifying digital signatures. A patch is available in version =...

Singularity Image Format 加密问题漏洞

Singularity Image Format is a compressed squashfs file system from Singularity that has a block organization structure, including metadata and definition files for containers, first labels, partition contents, signatures if they exist, and, of course, the containers for the binaries themselves...