CVE-2019-14859

A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable...

UBUNTU-CVE-2019-14853

An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could lead to a denial of service...

Faster JWT Key Rotation in API Gateway

JSON Web Tokens JWT use digital signatures to establish the authenticity of the data they contain, as well as authenticating the identity of the signer. A valid signature check ensures that any party can rely on the contents and the...

PT-2019-4890

Name of the Vulnerable Software and Affected Versions python-ecdsa versions prior to 0.13.3 Description A flaw was found in the python-ecdsa library where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making t...

PT-2019-4889

Name of the Vulnerable Software and Affected Versions python-ecdsa versions 0.5 through 0.13.2 Description A flaw in the error-handling mechanism of python-ecdsa could lead to a denial of service when decoding malformed DER signatures. This issue may cause unexpected exceptions or no exceptions a...

openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2249)

This update for MozillaThunderbird to version 68.1.1 fixes the following issues : - CVE-2019-11709: Fixed several memory safety bugs. bsc1140868 - CVE-2019-11710: Fixed several memory safety bugs. bsc1140868 - CVE-2019-11711: Fixed a script injection within domain through inner window reuse...

CVE-2019-14853

An error-handling flaw was found in python-ecdsa. During signature decoding, malformed DER signatures could raise unexpected exceptions or no exceptions at all, which could lead to a denial of service...

CVE-2019-17121

REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values...

Design/Logic Flaw

REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values...

CVE-2019-17121

REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values...

Amazon Linux 2 : nss (ALAS-2019-1305)

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41. CVE-2018-12404 Libgcrypt before 1.7.10 and...

PT-2019-14959

Name of the Vulnerable Software and Affected Versions REDCap versions prior to 9.3.4 Description The issue concerns a problem with the Customize & Manage Locking/E-signatures page, where it is possible to perform XSS attacks via Lock Record Custom Text values. Recommendations For versions prior t...

Cisco IOS XE Image Verification Malware Installation

The vulnerability of the Image Verification function in the Cisco IOS XE operating system is related to the lack of verification of file signatures during the system’s loading process. Exploiting this vulnerability allows a perpetrator to install malware onto a vulnerable device or load malicious...

Hack Breaks PDF Encryption, Opens Content to Attackers

Researchers in Germany have invented a new hack that can allow someone to break the encryption of PDF files and access their content — or even forge signed PDF files under certain circumstances. A team from Ruhr University Bochum, FH Münster University of Applied Sciences and Hackmanit GmbH...

SUSE-SU-2019:2515-1 Security update for MozillaThunderbird

This update for MozillaThunderbird to version 68.1.1 fixes the following issues: - CVE-2019-11709: Fixed several memory safety bugs. bsc1140868 - CVE-2019-11710: Fixed several memory safety bugs. bsc1140868 - CVE-2019-11711: Fixed a script injection within domain through inner window reuse...

Medium: nss

Issue Overview: A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack and affects all NSS versions prior to NSS 3.41. CVE-2018-12404 Libgcrypt...

PT-2019-14862

Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.19.0 Arm Mbed Crypto versions prior to 2.0.0 Description The issue arises when deterministic ECDSA is enabled, and an RNG with insufficient entropy for blinding is used. This might allow an attacker to recover ...

CVE-2019-12649

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected...

Design/Logic Flaw

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability exists because, under certain circumstances, an affected...

CVE-2019-12649

The CVE-2019-12649 vulnerability affects Cisco IOS XE Software, specifically the Image Verification feature. Under certain conditions, a device could be configured to skip digital signature verification of system image files during the boot process, enabling an authenticated, local attacker to in...