Input validation

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

wolfSSL 信任管理问题漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded systems developers from Wolfssl, Inc. in the United States. A security vulnerability exists in wolfSSL versions prior to 5.2.0, which stems from an application attempting to authenticate a TLS 1.3 client to a...

PT-2022-17425 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.2.0 Description: The issue allows certificate validation to be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig algo field differs between the certificate...

libreoffice trust management issue vulnerability (CNVD-2022-55626)

LibreOffice is an open source office software suite from The Document Foundation tdf. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. A trust management issue vulnerability exists in libreoffice, which stems from libreoffice: signature...

CVE-2022-23655 Missing server signature validation in OctoberCMS

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

CVE-2022-23655

CVE-2022-23655 affects Octobercms (Laravel-based) where affected versions did not validate gateway server signatures. This allows non-authoritative gateway servers to exfiltrate user private keys. The fix is available via upgrading to build 474 or v1.1.10, or applying the patch commit e3b455ad587...

CVE-2022-23655 Missing server signature validation in OctoberCMS

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. Affected versions of OctoberCMS did not validate gateway server signatures. As a result non-authoritative gateway servers may be used to exfiltrate user private keys. Users are advised to upgrade their installations to...

Security Bulletin: Vulnerability in MD5 Signature and Hash Algorithm affects IBM Security Network Intrusion Prevention System (CVE-2015-7575)

Summary The MD5 “SLOTH” vulnerability on TLS 1.2 affects IBM Security Network Intrusion Prevention System. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The TLS protocol could allow weaker than expected security caused by a collision attack when using the MD5 hash function for signing a...

EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2022-1194)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where...

Updated cpanminus packages fix security vulnerability

The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. CVE-2020-16154...

MGASA-2022-0078 Updated cpanminus packages fix security vulnerability

The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass. CVE-2020-16154...

Security Bulletin: OpenSSL DSA signature algorithm security vulnerability affects IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-0734)

Summary The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack which could allow a remote atacker to obtain sensitive information. This can affect IBM Spectrum Control formerly Tivoli Storage Productivity Center. Vulnerability Details CVEID:...

Improper Certificate Validation in Cosign

Impact Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing"...

GHSA-CCXC-VR6P-4858 Improper Certificate Validation in Cosign

Impact Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and push permissions for the signature in OCI. This can happen with both standard signing with a keypair and "keyless signing"...

Moderate: Red Hat Security Advisory: rpm security update

An update for rpm is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2021-25636

A improper certificate validation flaw was found in LibreOffice allowing an attacker to manipulate a digitally signed ODF document to appear that no alteration of the document occurred since the last signing and that the signature is valid...

CVE-2021-25636

LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to...

permit() without updating nonce can result in replay attacks

Lines of code Vulnerability details Impact In PermitAndMulticall.sol the permit is called on the permitToken which allows you to sign the meta-transaction while someone else can submit it to the blockchain on your behalf. The problem is that a valid signature might be used several times in other...

LibreOffice 信任管理问题漏洞

LibreOffice is an open source office software suite from The Document Foundation tdf. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. A trust management issue vulnerability exists in libreoffice, which stems from libreoffice: signature...

Cosign Trust Management Issue Vulnerability

Cosign is a container signature, verification and storage in the Oci registry in the U.S. Versions prior to Cosign 1.5.2 are vulnerable to trust management issues, which can be exploited by attackers to access signatures in the OCI and manipulate cosign...