SUSE CVE-2019-11755

A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature, although the signer might have had no access to the contents of the encrypted message, and might have stripped a different signature from the encrypted...

DEBIAN-CVE-2014-0147

Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling updaterefcount routine...

GHSA-J473-C3RR-RX9P OpenID4Java does not verify that Attribute Exchange (AX) information is signed

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...

GHSA-6R5V-HP32-FJQW Improper Access Control in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."...

CVE-2020-16155

The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data...

CVE-2020-16155

The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data...

UBUNTU-CVE-2020-16155

The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data...

CVE-2020-16155

The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data...

CVE-2020-16155

The CPAN::Checksums package 2.12 for Perl does not uniquely define signed data...

PT-2021-9867 · Unknown +2 · Cpan::Checksums +2

Name of the Vulnerable Software and Affected Versions: CPAN::Checksums version 2.12 Description: The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or...

Unspecified vulnerability in Ratpack (CNVD-2021-52414)

Ratpack is a Java library for building scalable HTTP applications. A security vulnerability exists in Ratpack versions prior to 1.9.0, which stems from a default configuration of a client session that results in unencrypted but signed data being set as a cookie value. An attacker could exploit th...

Design/Logic Flaw

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

CVE-2021-29481

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

CVE-2021-3196

An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management authenticating via SAML through a third-party identity provider, an attacker can inject additional data into a signed SAML response bein...

Lack of chain information in the signed data leads to potential replay attacks.

Handle shw Vulnerability details Impact The Offer structure, whose hash is signed by a maker, does not contain information of the current chain. Therefore, the signature is valid on all EVM-compatible chains. In the situation of a future hard fork of the Ethereum network, the valid signatures on...

CVE-2017-9106

An issue was discovered in adns before 1.5.2. adnsrrinfo mishandles a bogus datap. The general pattern for formatting integers is to sprintf into a fixed-size buffer. This is correct if the input is in the right range; if it isn't, the buffer may be overrun depending on the sizes of the types on...

CVE-2014-0147

CVE-2014-0147 affects QEMU before 1.6.2, where a logic error with signed data types during QCOW2 snapshot creation (impacting QCOW2 and disk image formats used by Bochs) can cause a crash by incorrectly calling update_refcount(). Root cause is a signed data type/logical error in snapshot handling...

Mozilla Firefox ESR < 52.5 Multiple Vulnerabilities

Binary data 700332.prm...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

It was found that Apache WSS4J permitted bypass of the requireSignedEncryptedDataElements configuration property via XML Signature wrapping attacks. A remote attacker could use this flaw to modify the contents of a signed request...