CVE-2022-23649: Improper Certificate Validation

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

cosign:fuzz_getPassword: Crash in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5039668471660544 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000000001688 Crash State: pthreadcreate cgotrypthreadcreate...

cosign:fuzz_getPassword: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=6396103086964736 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...

cosign:fuzz_getPassword: Null-dereference READ in pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5212354219474944 Project: cosign Fuzzing Engine: libFuzzer Fuzz Target: fuzzgetPassword Job Type: libfuzzerasancosign Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...

4 Major Privacy and Security Updates From Google You Should Know About

Google has announced a number of user-facing and under-the-hood changes in an attempt to boost privacy and security, including rolling out two-factor authentication automatically to all eligible users and bringing iOS-styled privacy labels to Android app listings. "Today we ask people who have...

Cosign 2.0.1/2.9.4a CGI Register Command Remote Authentication Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/23424/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An authenticated attacker can exploit this issue to access services hoste...

SA-CONTRIB-2011-022 - Cosign - SQL Injection

Under certain conditions the module deletes uid 1 and then does an unparameterized dbquery to insert a new uid 1. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site configuration" and must be able to remotely manipulate the web serve...

Command injection

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR \r sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username...

Authentication flaw

The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...

CVE-2007-2232

The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...

CVE-2007-2232

CVE-2007-2232 concerns the Cosign vulnerability where the CHECK command in Cosign 2.0.1 and earlier can be abused to bypass authentication through CR (\r) sequences in the cosign cookie parameter. Affected software is Cosign up to version 2.0.1 and earlier; the underlying issue is improper handli...

CVE-2007-2233

Cosign 2.0.2 and earlier (cosign-bin/cosign.cgi) are affected. The issue allows remote authenticated users to perform unauthorized actions as an arbitrary user by injecting LOGIN and REGISTER commands via CR (\r) sequences in the service parameter. Root cause is input handling that does not neutr...

CVE-2007-2232

The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...

CVE-2007-2233: Undefined Security Weakness

cosign-bin/cosign.cgi in Cosign 2.0.2 and earlier allows remote authenticated users to perform unauthorized actions as an arbitrary user by using CR \r sequences in the service parameter to inject LOGIN and REGISTER commands with the desired username...

CVE-2007-2232: Undefined Security Weakness

The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR \r sequences in the cosign cookie parameter...

Cosign 2.0.12.9.4a - CGI Check Cookie Command Remote Authentication Bypass

Cosign 2.0.12.9.4a - CGI Check Cookie Command Remote Authentication Bypass source: https://www.securityfocus.com/bid/23422/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An attacker can exploit this iss...

[Full-disclosure] Cosign SSO Authentication Bypass

Author: Jon Oberheide [email protected] Date: Wed, April 11th, 2007 Summary ======= Application: Cosign Single Sign-On Affected Versions: 2.0.1 and previous Vendor Website: http://weblogin.org Type of Vulnerability: Authentication Bypass - Remote Background ========== cosign is a web single-sign-...

Cosign 2.0.1/2.9.4a - CGI Check Cookie Command Remote Authentication Bypass

source: https://www.securityfocus.com/bid/23422/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An attacker can exploit this issue to gain unauthorized access to services hosted on an affected computer...

Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass

source: https://www.securityfocus.com/bid/23424/info The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input. An authenticated attacker can exploit this issue to access services hosted on an affected computer by...