CVE-2020-1026

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve Cryptography ECC implementation.An attacker could potentially abuse these bugs to learn information about a server’s private ECC key a key...

Fedora: Security Advisory for php-robrichards-xmlseclibs1 (FEDORA-2020-1b95d7a131)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-robrichards-xmlseclibs1 (FEDORA-2020-46d0f456a9)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: php-robrichards-xmlseclibs1-1.4.3-1.fc31

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required -- specifically for the following XMLSecurityKey encryption type...

[SECURITY] Fedora 30 Update: php-robrichards-xmlseclibs1-1.4.3-1.fc30

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures. NOTE: php-mcrypt will not be automatically installed as a dependency of this package so it will need to be "manually" installed if it is required -- specifically for the following XMLSecurityKey encryption type...

Authentication Bypass

java is vulnerable to authentication bypass. A flaw was found in the way the XML Digital Signature implementation in the JRE handled HMAC-based XML signatures. An attacker could use this flaw to create a crafted signature that could allow them to bypass authentication, or trick a user, applet, or...

Update for SIP to enable WinVerifyTrust function in Windows Server 2008 R2 SP1 to work with a later version of Windows

Update for SIP to enable WinVerifyTrust function in Windows Server 2008 R2 SP1 to work with a later version of Windows About this update Subject Interface Packages SIPs are required in order to read the digital signatures on specific file types. After you install this update, SIPs enable the...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-40816)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by attackers to bypass the ko i.e. kernel module signature by modifying the number of...

CVE-2017-18689

An issue was discovered on Samsung mobile devices with M6.0 and N7.0 Exynos5433, Exynos7420, or Exynos7870 chipsets software. An attacker can bypass a ko aka Kernel Module signature by modifying the count of kernel modules. The Samsung ID is SVE-2016-7466 January 2017...

GHSA-8QXJ-F9RH-9FG2 Improper Verification of Cryptographic Signature in Pure-Python ECDSA

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

DEBIAN-CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

UBUNTU-CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

CVE-2019-17561

Summary: CVE-2019-17561 affects Apache NetBeans, where the autoupdate system does not fully validate code signatures, allowing an attacker to modify downloaded nbm packages. This vulnerability impacts NetBeans releases up to and including 11.2. The available documents describe the root cause as i...

CVE-2019-17561

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability...

CVE-2019-14855

A flaw was found in OpenPGP Key Certification Forgeries in the way certificate signatures could be forged by using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures...

PT-2020-4107

Name of the Vulnerable Software and Affected Versions: Apache NetBeans versions up to and including 11.2 Description: The issue is related to insufficient validation of input data in the Apache NetBeans autoupdate system, which does not fully validate code signatures. This could allow a remote...

OPENSUSE-SU-2020:0403-1 Security update for strongswan

This update for strongswan fixes the following issues: Strongswan was updated to version 5.8.2 jscSLE-11370. Security issue fixed: - CVE-2018-6459: Fixed a DoS vulnerability in the parser for PKCS1 RSASSA-PSS signatures that was caused by insufficient input validation bsc1079548. Full changelogs:...

Amazon Linux 2 : thunderbird (ALAS-2020-1408)

The version of thunderbird installed on the remote host is prior to 68.5.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1408 advisory. When deriving an identifier for an email message, uninitialized memory was used in addition to the message contents...