CVE-2024-29050 Windows Cryptographic Services Remote Code Execution Vulnerability

...

google-oauth-java-client improperly verifies cryptographic signature

Summary The vulnerability impacts only users of the IdTokenVerifier class. The verify method in IdTokenVerifier does not validate the signature before verifying the claims e.g., iss, aud, etc.. Signature verification makes sure that the token's payload comes from valid provider, not from someone...

USN-6726-1: Linux kernel vulnerabilities

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service host domain crash...

USN-6726-1 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-kvm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-raspi-5.4 vulnerabilities

Pratyush Yadav discovered that the Xen network backend implementation in the Linux kernel did not properly handle zero length data request, leading to a null pointer dereference vulnerability. An attacker in a guest VM could possibly use this to cause a denial of service host domain crash...

Microsoft Windows Cryptographic Services 安全漏洞

Microsoft Windows Cryptographic Services is a cryptographic service provider program from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Cryptographic Services. An attacker exploiting this vulnerability could bypass certain features. The following products and...

Microsoft Windows Cryptographic Services 安全漏洞

Microsoft Windows Cryptographic Services is a cryptographic service provider program from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Cryptographic Services. The following products and versions are affected:Windows 10 Version 1809 for 32-bit Systems,Windows 10...

PT-2024-3295

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Windows authentication mechanism, which involves the use of defective cryptographic algorithms. This vulnerability can b...

ROS-20240409-15

Vulnerability of the GnuTLS transport layer cryptographic library is related to errors in verification of the of cryptographic signatures. Exploitation of the vulnerability allows an attacker acting remotely to cause a denial of service...

The vulnerability of the OSBuild Composer service, related to improper verification of the cryptographic signature, allows a hacker to execute a “man-in-the-middle” attack.

The vulnerability of the OSBuild Composer service for creating system load images is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow a attacker to execute a “man-in-the-middle” attack...

RLSA-2024:1608 Moderate: opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor with the PKCS11 firmware loaded, the IBM eServer Cryptographic Accelerator FC 4960 ...

The vulnerability of the PowerScale OneFS operating system, related to the use of cryptographic algorithms containing defects, allows a perpetrator to disclose protected information.

The vulnerability of the PowerScale OneFS operating system is related to the use of cryptographic algorithms that contain defects. Exploiting this vulnerability allows a malicious actor to disclose the protected information...

Mageia: Security Advisory (MGASA-2024-0089)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the Grafana monitoring and observation platform lies in improper verification of the cryptographic signature. This allows a malicious actor to install malware on a vulnerable device.

The vulnerability of the Grafana monitoring and observation platform relates to bypassing the plugin signature verification process. Exploiting this vulnerability allows a malicious actor to install malware on a vulnerable device remotely...

The vulnerability of the program tools and libraries used for working with OpenSC smart cards involves improper authentication procedures. This allows attackers to gain unauthorized access, perform arbitrary actions, or compromise the system.

The vulnerability of the software tools and libraries used for working with OpenSC smart cards stems from the fact that token/card authentication can be performed as a cryptographic operation in other processes when a null-length PIN code is transmitted. Exploiting this vulnerability could allow ...

ROS-20240404-08

Vulnerability of GnuTLS transport layer cryptographic library is related to difference of response time when processing RSA ciphertext in ClientKeyExchange message with correct and incorrect addition of PKCS1. PKCS1 padding. Exploitation of the vulnerability could allow an attacker acting remotel...

Google Chrome Beta Tests New DBSC Protection Against Cookie-Stealing Attacks

Google on Tuesday said it's piloting a new feature in Chrome called Device Bound Session Credentials DBSC to help protect users against session cookie theft by malware. The prototype – currently tested against "some" Google Account users running Chrome Beta – is built with an aim to make it an op...

CVE-2024-0394: Rapid7 Minerva Armor Privilege Escalation (FIXED)

Rapid7 is disclosing CVE-2024-0394, a privilege escalation vulnerability in Rapid7 Minerva’s Armor product family. Minerva uses the open-source OpenSSL library for cryptographic functions and to support secure communications. The root cause of this vulnerability is Minerva’s implementation of...

LSN-0102-1: Kernel Live Patch Security Notice

It was discovered that a race condition existed in the iouring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code.CVE-2023-1872 Lonial Con discovered that the...

LSN-0102-1 Kernel Live Patch Security Notice

It was discovered that a race condition existed in the iouring subsystem in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execute arbitrary code.CVE-2023-1872 Lonial Con discovered that the...

Westermo WeOS Cryptographic Issues (CVE-2015-7923)

Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in- the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key. This plugin only works with Tenable.ot. Please visit...