Red Hat Enterprise Linux 资源管理错误漏洞

Red Hat Enterprise Linux is a Linux operating system for business users from Red Hat, Inc. A security vulnerability exists in Red Hat Enterprise Linux 7 that stems from the inclusion of an incorrect version of podman, which could cause Go applications using the Go GPGME wrapper library to crash o...

Amazon Linux 2 : gnupg2 (ALAS-2022-1834)

The version of gnupg2 installed on the remote host is prior to 2.0.22-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1834 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in...

oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken

Ward Beullens found a practical key-recovery attack against Rainbow. The level I parametersets are removed from liboqs starting from version 0.7.2. Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop. This means all the oqs::sig::Algorithm::RainbowI variants are insecure...

GHSA-H864-M8VM-3XVJ oqs's Post-Quantum Signature scheme Rainbow level I parametersets broken

Ward Beullens found a practical key-recovery attack against Rainbow. The level I parametersets are removed from liboqs starting from version 0.7.2. Find the scientific details in Breaking Rainbow Takes a Weekend on a Laptop. This means all the oqs::sig::Algorithm::RainbowI variants are insecure...

GHSA-4H98-2769-GH6H OpenZeppelin Contracts vulnerable to ECDSA signature malleability

Impact The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single bytes argument, and not the...

OpenZeppelin Contracts vulnerable to ECDSA signature malleability

Impact The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issue for the functions that take a single bytes argument, and not the...

MAL-2022-52 Malicious code in @7tv/playback-signature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a90453bb6afe0a129bd8f7c4376d2efd10af9aef8302340ce34e7b6ec4c4819d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @7tv/playback-signature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a90453bb6afe0a129bd8f7c4376d2efd10af9aef8302340ce34e7b6ec4c4819d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-28751

The Zoom Client for Meetings for MacOS Standard and for IT Admin before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

Design/Logic Flaw

The Zoom Client for Meetings for MacOS Standard and for IT Admin before version 5.11.3 contains a vulnerability in the package signature validation during the update process. A local low-privileged user could exploit this vulnerability to escalate their privileges to root...

USN-5526-2 pyjwt regression

USN-5526-1 fixed vulnerabilities in PyJWT. Unfortunately this caused a regression by incrementing the internal package version number on Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Aapo Oksman discovered that PyJWT incorrectly...

Zoom Client 数据伪造问题漏洞

Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A data forgery issue vulnerability exists in Zoom Client for Meetings for MacOS Standard and for IT Admin versions prior to 5.11.3, which stems from the inclusion of a package signature...

PT-2022-4374 · Zoom · Zoom Client For Meetings

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings for macOS versions 5.7.3 through 5.11.6 Description: The issue is related to a vulnerability in the auto update process, which could allow a local low-privileged user to escalate their privileges to root. This is due ...

PT-2022-4376 · Zoom · Zoom Rooms For Conference Room For Windows +1

Name of the Vulnerable Software and Affected Versions: Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 Zoom Client for Meetings for macOS affected versions not specified Description: The issue is related to a Local Privilege Escalation vulnerability that could be exploited by a...

PT-2022-4375 · Zoom · Zoom Client For Meetings

Name of the Vulnerable Software and Affected Versions: Zoom Client for Meetings versions prior to 5.11.3 Description: The issue is related to incorrect cryptographic signature validation in the update process of the Zoom Client for Meetings for macOS. This could allow a local low-privileged user ...

The vulnerability of the automatic update function for conducting audio and video conferences in real-time with Zoom Client for Meetings for macOS allows a malicious individual to elevate their privileges to root level.

The vulnerability of the automatic update function for conducting real-time audio and video conferences in Zoom Client for Meetings for macOS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker to elevate their privileges to the...

Format string

OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...

dotnet: External Entity Injection during XML signature verification

An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...

dotnet: External Entity Injection during XML signature verification

An information disclosure vulnerability exists in .NET Core and .NET. This issue can lead to unauthorized access to privileged information...

Moderate: Red Hat Security Advisory: .NET Core 3.1 security, bug fix, and enhancement update

An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...