5239 matches found
Security Bulletin: Security Vulnerability found in zlib fixed in the zlib version shipped with IBM Security Verify for Gateway (RADIUS & WinLogin) and for Bridge (DirSync)
Summary The security vulnerabilityheap-based buffer overflow found in zlib was fixed in the following products: IBM Security Verify Gateway for RADIUS v1.0.8, IBM Security Verify Gateway for Windows Login v1.0.9 and IBM Security Verify Bridge for Directory Sync v1.0.10 Vulnerability Details...
woodenpallet.net Cross Site Scripting vulnerability OBB-3089102
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of Apache Commons Collections (multiple vulnerabilities)
Summary IBM Security Verify Governance uses Apache Commons Collections library which is vulnerable to arbitrary code execution by an attacker by sending specially crafted serialized objects CVE-2017-15708, CVE-2015-7501, CVE-2015-6420, CVE-2015-4852, CVE-2019-13116. The fix includes upgrading the...
Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security threats due to use of XStream
Summary IBM Security Verify Governance uses XStream which is vulnerable to multiple security threats which could allow attackers to perform various attacks like denial of service, arbitrary code execution, file deletion and server-side request forgery. The fix involves upgrading the XStream jar t...
bind security update
32:9.16.23-5 - Fix possible serve-stale related crash CVE-2022-3080 - Fix memory leak in ECDSA verify processing CVE-2022-38177 - Fix memory leak in EdDSA verify processing CVE-2022-38178 32:9.16.23-4 - Export bind-doc package 2104863 32:9.16.23-3 - Tighten cache protection against record from...
Security Bulletin: IBM Security Verify Governance is vulnerable to arbitrary code execution due to use of dom4j (CVE-2018-1000632)
Summary IBM Security Verify Governance uses dom4j could allow a remote attacker to execute arbitrary code on the system, caused by improper input validation in multiple methods CVE-2018-1000632. The fix includes upgrading the dom4j jar to the patched version. Vulnerability Details...
jwt-verify-lib:jwt_verify_lib_fuzz_test: Use-of-uninitialized-value in protobuf_mutator::FixUtf8String
Detailed Report: https://oss-fuzz.com/testcase?key=6493059605200896 Project: jwt-verify-lib Fuzzing Engine: libFuzzer Fuzz Target: jwtverifylibfuzztest Job Type: libfuzzermsanjwt-verify-lib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
golang: crypto/tls: certificate of wrong type is causing TLS client to panic
A flaw was found in golang. A panic can be triggered by an attacker in a privileged network position without access to the server certificate's private key, as long as a trusted ECDSA or Ed25519 certificate for the server exists or can be issued, or the client is configured with...
bind9.16 security update
32:9.16.23-0.9.1 - Fix possible serve-stale related crash CVE-2022-3080 - Fix memory leak in ECDSA verify processing CVE-2022-38177 - Fix memory leak in EdDSA verify processing CVE-2022-38178 32:9.16.23-0.9 - Tighten cache protection against record from forwarders CVE-2021-25220 - Include test of...
CLSA-2022-1668120434 perl: Fix of CVE-2020-16156
CVE-2020-16156: recognize CANNOTVERIFY signature verification type...
CLSA-2022-1668118081 Fix CVE(s): CVE-2020-16156
SECURITY UPDATE: Signature verification bypass - debian/patches/fixes/CVE-2020-16156.patch: recognize CANNOTVERIFY signature verification type, add two new failure modes based on 'cpanpath' and improve interaction with external 'gpg' executable. - CVE-2020-16156...
CLSA-2022-1668032518 perl: Fix of CVE-2020-16156
CVE-2020-16156: recognize CANNOTVERIFY signature verification type...
CVE-2022-26023
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability...
jwt-verify-lib:jwt_verify_lib_fuzz_test: Use-of-uninitialized-value in google::protobuf::CEscapeAndAppend
Detailed Report: https://oss-fuzz.com/testcase?key=5387850762027008 Project: jwt-verify-lib Fuzzing Engine: libFuzzer Fuzz Target: jwtverifylibfuzztest Job Type: libfuzzermsanjwt-verify-lib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
CVE-2022-26023: Active Debug Code
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to disabling security features. An attacker can send a sequence of requests to trigger this vulnerability...
Security Bulletin: IBM Security Verify Access is vulnerable to execute arbitrary code due to jsr-sasign component. [CVE-2022-25898]
Summary jsr-sasign is used by IBM Security Verify Access product. This has been fixed by updating the version used by IBM Security Verify Access. CVE-2022-25898 Vulnerability Details CVEID:CVE-2022-25898 DESCRIPTION: Node.js jsrsasign module could allow a remote attacker to execute arbitrary code...
jwt-verify-lib:jwt_verify_lib_fuzz_test: Use-of-uninitialized-value in google::jwt_verify::verifyJwtWithoutTimeChecking
Detailed Report: https://oss-fuzz.com/testcase?key=6202982312312832 Project: jwt-verify-lib Fuzzing Engine: libFuzzer Fuzz Target: jwtverifylibfuzztest Job Type: libfuzzermsanjwt-verify-lib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
jwt-verify-lib:jwt_verify_lib_fuzz_test: Use-of-uninitialized-value in bn_mod_inverse_prime_mont_small
Detailed Report: https://oss-fuzz.com/testcase?key=4890365715152896 Project: jwt-verify-lib Fuzzing Engine: libFuzzer Fuzz Target: jwtverifylibfuzztest Job Type: libfuzzermsanjwt-verify-lib Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
