SUSE-SU-2022:1093-1 Security update for libreoffice

This update for libreoffice fixes the following issues: Update to version 7.2.5.1 jscSLE-18213: - CVE-2021-25636: Fixed an incorrect validation of digitally signed documents bsc1196456...

CVE-2021-30066

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...

CVE-2021-30066

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...

CVE-2021-30066

The CVE-2021-30066 entry applies to Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 (before 03.23) and Belden Tofino Xenon Security Appliance. A firmware-signature verification bypass for USB allows loading an arbitrary firmware image, enabling kernel/firmware upgrades with unsigned p...

CVE-2021-30066

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification for a USB stick can be bypassed. NOTE: this issue exists because of an...

Schneider Electric ConneXium Network Manager Software 数据伪造问题漏洞

Schneider Electric ConneXium Network Manager Software Schneider Electric Cnm is an industrial Ethernet network management software from Schneider Electric, France. A security vulnerability exists in the Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22/21/20 prior to version 03.23 and t...

SaltStack Improper Verification of Cryptographic Signature

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data...

GHSA-2Q4G-WFM6-5FPM SaltStack Improper Verification of Cryptographic Signature

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data...

Enforced Owner Can Extract Funds From The Contract

Lines of code Vulnerability details Impact During the code review, It has been observed that access control mechanisms are checked with the following line. LibDiamond.enforceIsContractOwner; The withdraw gaves abilitiy to contract owner extract all funds are sent to contract. This poses...

CVE-2015-3298

The CVE 2015-3298 entry covers Yubico ykneo-openpgp before 1.0.10, where a typo in PIN verification allows a signature to be issued on first power-up without validating the PIN. This is described across multiple connected sources (NVD/NVD-derived Red Hat advisory, CNVD, and Yubico Security Adviso...

Yubico ykneo-openpgp 数据伪造问题漏洞

Yubico ykneo-openpgp is an open source security product from the Swedish company Yubico. It implements the OpenPGP card functionality used on YubiKey NEO devices sold by Yubico. A data forgery issue vulnerability exists in versions prior to Yubico ykneo-openpgp 1.0.10. The vulnerability stems fro...

All swapping functions lack checks for returned tokens

Lines of code Vulnerability details Impact Every function that stems from the GenericSwapFacet lacks checks to ensure that some tokens have been returned via the swaps. In LibSwap.sol in the swap function, the swap call is sent to the target DEX. A return of success is required, otherwise the...

CVE-2021-44211

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature...

CVE-2021-44211

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature...

CVE-2021-44211

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature...

CVE-2021-44211

OX App Suite (Open-Xchange) up to version 7.10.5 is affected by a Cross-Site Scripting vulnerability in the HTML e-mail signature signature element class attribute. The issue is documented in CVE-2021-44211 and is triggered by an element’s class attribute, enabling XSS. Public writeups indicate v...

CVE-2021-44211

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature...

The vulnerability of the Mozilla Firefox browser, related to the race-like status during signature verification, allows a hacker to perform a spoofing attack.

The vulnerability of the Mozilla Firefox browser is related to a race condition that occurs during the process of checking signatures. Exploiting this vulnerability allows an attacker to perform a spoofing attack by replacing the default configuration file with a malicious one...

USN-5345-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass security restrictions, obtain sensitive information, cause undefined...

CVE-2022-22819

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers ROM version 1B have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted...