Security Bulletin: Security vulnerabilities have been identified in third party libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in the third party libraries shipped with IBM Guardium Cryptography Manager GCM have been addressed. Vulnerability Details CVEID:CVE-2026-12817 DESCRIPTION: In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned...

EUVD-2018-0139

Malware in sbrugna...

CVE-2023-28002

CVE-2023-28002 affects Fortinet FortiOS/ FortiGate VM where an improper validation of the integrity check value (CWE-354) can allow a local admin to boot a malicious image and bypass filesystem integrity checks. Affected: FortiOS/ FortiGate VM images on versions 7.2.0–7.2.3, 7.0.0–7.0.12, 6.4 (al...

Fortinet Fortigate VM - Bypass of root file system integrity checks at boot time on VM (FG-IR-22-396)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-396 advisory. - An improper validation of integrity check value vulnerability CWE-354 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12,...

CVE-2023-28002: Improper Validation of Integrity Check Value

An improper validation of integrity check value vulnerability CWE-354 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesyst...

Moxa TN-5900 Firmware Upgrade Checksum Validation

KL-001-2022-001: Moxa TN-5900 Firmware Upgrade Checksum Validation Vulnerability Title: Moxa TN-5900 Firmware Upgrade Checksum Validation Vulnerability Advisory ID: KL-001-2022-001 Publication Date: 2022.01.28 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2022-001.txt 1...

Moxa TN-5900 Firmware Upgrade Checksum Validation Vulnerability

Vulnerability Details Affected Vendor: Moxa Affected Product: TN-5900 Affected Version: v3.1 and prior Platform: Moxa Linux CWE Classification: CWE-354 Improper Validation of Integrity Check Value CVE ID: CVE-2021-46559 2. Vulnerability Description Moxa TN-5900 v3.1.0 and prior uses an insecure...

JVN#55917325: Multiple vulnerabilities in Aterm SA3500G

Aterm SA3500G provided by NEC Corporation contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2020-5635 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2| AV:A/AC:L/Au:N/C:P/I:P/A:P| Base Score: 5.8 OS...

GHSA-CWH5-3CW7-4286 tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

tlslite-ng off-by-one error on mac checking

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line endpos = datalen - 1 - mac.digestsize that can...

Input validation

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

CVE-2018-1000159

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

CVE-2018-1000159

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

PYSEC-2018-31

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...

CVE-2018-1000159

Removed by vendor...

CVE-2018-1000159

tlslite-ng

CVE-2018-1000159

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper Validation of Integrity Check Value vulnerability in TLS implementation, tlslite/utils/constanttime.py: ctcheckcbcmacandpad; line "endpos = datalen - 1 - mac.digestsize" that c...