6891 matches found
USN-4060-1: NSS vulnerabilities
Henry Corrigan-Gibbs discovered that NSS incorrectly handled importing certain curve25519 private keys. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly obtain sensitive information. CVE-2019-11719 Hubert Kario discovered that NSS incorrectly...
CVE-2019-0865
A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by creating a specially crafted connection or message.The security update addresses the vulnerability by correcting the way SymCrypt handles...
PT-2019-3221
Name of the Vulnerable Software and Affected Versions Keycloak versions up to 6.0.1 Description The issue is related to the SAML broker component, which does not properly verify missing message signatures. This allows an attacker to modify the SAML Response by removing the sections, and the messa...
PT-2019-2756
Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A denial of service issue exists due to improper handling of digital signatures by SymCrypt. An attacker can exploit this by creating a specially crafted connection or message, potentially...
RHEL 6 : spacewalk-backend (RHSA-2019:1661)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1661 advisory. Spacewalk is an Open Source systems management solution that provides system provisioning, configuration and patching capabilities. Security Fixes:...
SUSE SLED15 / SLES15 Security Update : evolution (SUSE-SU-2019:1266-2)
This update for evolution fixes the following issues : Security issue fixed : CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails bsc1125230. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...
GnuPG -- denial of service
From the GnuPG 2.2.17 changelog: gpg: Ignore all key-signatures received from keyservers. This change is required to mitigate a DoS due to keys flooded with faked key-signatures...
CVE-2019-13177
verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...
Design/Logic Flaw
verification.py in django-rest-registration aka Django REST Registration library before 0.5.0 relies on a static string for signatures i.e., the Django Signing API is misused, which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to...
Improper Verification of Cryptographic Signature in django-rest-registration
Misusing the Django Signer API leads to predictable signatures used in verification emails Impact The vulnerability is a high severity one. Anyone using Django REST Registration library versions 0.2. - 0.4. with e-mail verification option which is recommended, but needs additional configuration i...
spacewalk: Insecure computation of authentication signatures during user authentication
It was found that Spacewalk did not safely compute client token checksums. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum...
SUSE-SU-2019:1266-2 Security update for evolution
This update for evolution fixes the following issues: Security issue fixed: - CVE-2018-15587: Fixed an issue with spoofed pgp signatures by using specially crafted emails bsc1125230...
PT-2019-13169
Name of the Vulnerable Software and Affected Versions django-rest-registration versions 0.2. through 0.4. Description The issue arises from the misuse of the Django Signing API, leading to predictable signatures used in verification emails. This allows remote attackers to spoof the verification...
Yubico Security Keys with a Crypto Flaw
Wow, is this an embarrassing bug: Yubico is recalling a line of security keys used by the U.S. government due to a firmware flaw. The company issued a security advisory today that warned of an issue in YubiKey FIPS Series devices with firmware versions 4.4.2 and 4.4.4 that reduced the randomness ...
New Dridex Variant Slips By Anti-Virus Detection
Researchers have spotted a variant of the Dridex banking trojan with new obfuscation capabilities that help it skirt anti-virus detection. While Dridex has been around since 2011, researchers told Threatpost Friday that they recently spotted phishing emails distributing a never-before-seen varian...
Denial Of Service (DoS)
keycloak-connect is vulnerable to denial of service. Failure to validate JWT signatures on /klogout route allows remote attackers to force logout users and indefinitely deny service to the application using malicious JWTs with NBF values...
Forced Logout
Overview Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to...
GHSA-68HW-VFH7-XVG8 Forced Logout in keycloak-connect
Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...
Forced Logout in keycloak-connect
Versions of keycloak-connect prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the /klogout route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely. Recommendation Upgrade to version 4.4...
keycloak: missing signatures validation on CRL used to verify client certificates
A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself CDP or through the separately configured path. The CRL are often availab...