CVE-2023-3347

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

samba -- multiple vulnerabilities

The Samba Team reports: CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion DoS Vulnerability When parsing Spotlight mdssvc RPC packets, one encoded data structure is a key-value style dictionary where keys are character strings and values can be any of the supported types in the...

UBUNTU-CVE-2023-3347

A vulnerability was found in Samba's SMB2 packet signing mechanism. The SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. This flaw allows an attacker to perform attacks, suc...

SMB2 packet signing not enforced

Description SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. SMB2 packet signing is a mechanism that ensures the integrity and authenticity of data exchanged between a clien...

CVE-2023-37464

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the Tag length from the actual Authentication Tag provided in the JWE. The spec says that a fixed length of 16 octets must be applied. Therefore this bug...

CVE-2023-30559

The firmware update package for the wireless card is not properly signed and can be modified...

PT-2023-22786 · Unknown · Wireless Card Firmware

Name of the Vulnerable Software and Affected Versions: Wireless card firmware affected versions not specified Description: The issue concerns the firmware update package for the wireless card, which is not properly signed and can be modified. Additionally, the configuration from the PCU can be...

Old certificate, new signature: Open-source tools forge signature timestamps on Windows drivers

Cisco Talos has observed threat actors taking advantage of a Windows policy loophole that allows the signing and loading of cross-signed kernel mode drivers with signature timestamp prior to July 29, 2015. Actors are leveraging multiple open-source tools that alter the signing date of kernel mode...

Windows published desktop Signing out immediately after Logging on.

To reproduce error: 1. login to Store Front, and launch Desktop 2. New application window opens shows "Notice - Proprietary System" screen. Click OK. 3. Desktop launch begins: Starts to spin and login the user, "Please wait for Citrix Profile Management" 4. "Preparing Windows" and then goes to a...

Microsoft Windows Authenticode 安全漏洞

Microsoft Windows Authenticode is a code-signing technology from Microsoft Corporation USA that identifies the publisher of Authenticode-signed software. A security vulnerability exists in Microsoft Windows Authenticode. An attacker exploits this vulnerability to perform spoofing attacks...

Service Provider SAML Signing Certificate FAQ

Q: What is SAML signing? A: SAML signing certificates are X.509 certificates used to verify data sent between the Service Provider SP and SAML provider IdP. Your SAML provider IdP uses the Citrix Cloud SAML signing certificate to verify the signature sent by Citrix Cloud within its SAML...

CVE-2023-32229

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option signing of the video stream with option MD5, SHA-1 or SHA-256...

CVE-2023-32229

Due to an error in the software interface to the secure element chip on Bosch IP cameras of family CPP13 and CPP14, the chip can be permanently damaged when enabling the Stream security option signing of the video stream with option MD5, SHA-1 or SHA-256...

CVE-2023-32229

CVE-2023-32229 affects Bosch IP cameras in the CPP13/CPP14 families. The issue arises from an error in the software interface to the secure element chip, which can permanently damage the chip when enabling the Stream security option (signing the video stream) with MD5, SHA-1 or SHA-256. Public re...

PT-2023-23672 · Bosch · Bosch Ip Cameras

Name of the Vulnerable Software and Affected Versions: Bosch IP cameras of family CPP13 and CPP14 affected versions not specified Description: The issue arises from an error in the software interface to the secure element chip. This error can cause permanent damage to the chip when the Stream...

grub2 security update

2.06-46.0.4.el91.3 - Bump SBAT metadata for grub to 3 Orabug: 34872719 - Fix CVE-2022-3775 Orabug: 34871953 - Enable signing for aarch64 EFI - Fix signing certificate names - Enable back btrfs grub module for EFI pre-built image Orabug: 34360986 - Replaced bugzilla.oracle.com references Orabug:...

CVE-2023-33959

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Use...

Design/Logic Flaw

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The...

Ask Fitis, the Bear: Real Crooks Sign Their Malware

Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to...

Fedora: Security Advisory for keyring-ima-signer (FEDORA-2023-37ae269843)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...