4553 matches found
Unsafe Signing Using A Broken Entropy Sources
crypto/ecdsa in github.com/golang/go is vulnerable to unsafe signing. It can happen because it uses a signing key generated using a broken entropy of rand...
CVE-2017-0897: Use of Insufficiently Random Values
ExpressionEngine version 2.x 2.11.8 and version 3.x 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution...
Oracle Linux 7 : kernel (ELSA-2017-1484-1)
Description of changes: 3.10.0-514.21.2.0.1.el7.OL7 - ipc ipc/sem.c: bugfix for semctl,,GETZCNT Manfred Spraul orabug 22552377 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel olkmodsigningkey.x509alexey.petrenko at oracle.com - Update...
FAQ: XenMobile Derived Credentials
What are Derived Credentials? Derived credentials provide strong authentication for mobile devices. The credentials, derived from a smart card, reside in a mobile device instead of the card. The smart card is either a Personal Identity Verification PIV card or Common Access Card CAC. The derived...
UBUNTU-CVE-2017-9526
In Libgcrypt before 1.7.7, an attacker who learns the EdDSA session key from side-channel observation during the signing process can easily recover the long-term secret key. 1.7.7 makes a cipher/ecc-eddsa.c change to store this session key in secure memory, to ensure that constant-time point...
Cisco Context Service SDK Arbitrary Code Execution Vulnerability
A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service software development kit SDK could allow an unauthenticated, remote attacker to execute arbitrary code on the affected device with the privileges of the web server. The vulnerability is due to insufficient...
Lenovo Service Bridge Spoofing Vulnerability
Lenovo Service Bridge is a Windows program from the Chinese company Lenovo Lenovo that automatically detects the serial number and model number of your device. A spoofing vulnerability exists in the signature verification logic in code signing certificates in versions prior to Lenovo Service Brid...
CVE-2016-8231
In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate...
CVE-2016-8231: Improper Certificate Validation
In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate...
CVE-2016-8231
In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate...
CVE-2016-8231
In CVE-2016-8231, Lenovo Service Bridge prior to version 4 contains a flaw in the signature verification logic of code signing certificates that could allow a forged certificate to be accepted. Affected product: Lenovo Service Bridge (LSB) on Windows. Root cause: incorrect/weak signature verifica...
PT-2017-9546
Name of the Vulnerable Software and Affected Versions Lenovo Service Bridge versions prior to 4 Description A bug was found in the signature verification logic of the code signing certificate in Lenovo Service Bridge, which could be exploited by an attacker to insert a forged code signing...
Bitdefender in processing PE code signing the organizationName field when there is buffer overflow vulnerability-vulnerability warning-the black bar safety net
A vulnerability summary This paper describes the Bitdefender PE engine in the presence of a buffer overflow vulnerability. Bitdefender provides“anti-malware antimalware”of the engine, the engine can be integrated to other security vendors ' products, Bitdefender in their products, such as...
WordPress: WordPress Automatic Update Protocol Does Not Authenticate Updates Provided by the Server
When the WordPress automatic update process is initiated likely via wp-cron.php, this is the path the code takes: https://github.com/WordPress/WordPress/blob/4a6f90db58a935abb688cfb91b391dffeda7b35c/wp-admin/includes/class-wp-upgrader.phpL242-L283...
Lenovo Service Bridge Contains Privilege Escalation and Other Vulnerabilities - us
Lenovo Security Advisory: LEN-10149 Potential Impact: Local privilege escalation, cross-site request forgery, insecure connection, possibility to insert a forged code signing certificate Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2016-8228, CVE-2016-8229, CVE-2016-8230,...
Lenovo Service Bridge Contains Privilege Escalation and Other Vulnerabilities - Lenovo Support US
No description provided...
Citrix Cloud Connector Installation does not complete: Unable to validate certificate chain
Citrix Cloud Connector does not complete its initial installation or is unable to upgrade to the latest Cloud Connector version. The installation is blocked because it’s not able to validate the code signing certificate of the Citrix Cloud Components downloaded, which may be due to the certificat...
OpenJDK: MD5 allowed for jar verification (Security, 8171121)
It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm...
OpenJDK: MD5 allowed for jar verification (Security, 8171121)
It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm...
OpenJDK: MD5 allowed for jar verification (Security, 8171121)
It was discovered that the Security component of OpenJDK did not allow users to restrict the set of algorithms allowed for Jar integrity verification. This flaw could allow an attacker to modify content of the Jar file that used weak signing key or hash algorithm...