UBUNTU-CVE-2025-0306

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service...

CVE-2025-0306

CVE-2025-0306 concerns the Ruby interpreter and a Marvin Attack that can decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service. The connected docs corroborate Ruby advisories for EulerOS (ruby package security advisories Eul...

Ruby 安全漏洞

Ruby is a cross-platform, object-oriented, dynamically typed programming language from the personal developer Yukihiro Matsumoto. A security vulnerability exists in Ruby that stems from vulnerability to the Marvin attack, which allows an attacker to decrypt previously encrypted messages or forge...

CVE-2025-0306: Covert Timing Channel

A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service...

CVE-2024-52295

What is affected: DataEase (open source data visualization/analysis tool). Vulnerability: Prior to version 2.10.2, DataEase allows forging of JWTs to take over services. The underlying issue is that the JWT secret is hardcoded, and the UID/OID are also hardcoded. Impact: High confidentiality, int...

CVE-2024-44730: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Incorrect access control in the function handleDataChannelChatdataMessage of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name...

CVE-2024-44730

Incorrect access control in the function handleDataChannelChatdataMessage of Mirotalk before commit c21d58 allows attackers to forge chat messages using an arbitrary sender name...

CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud

Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...

CVE-2024-9160

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-9160

The CVE-2024-9160 entry concerns the PEADM Forge Module, where versions prior to 3.24.0 are affected by a security misconfiguration. Multiple connected sources confirm the vulnerable scope is before 3.24.0 and recommend upgrading to 3.24.0 or later as the fix. No exploit details are provided in t...

CVE-2024-9160 Security Misconfiguration in Forge module PEADM

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-9160 Security Misconfiguration in Forge module PEADM

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

PT-2024-39462 · Unknown · Peadm Forge Module

Name of the Vulnerable Software and Affected Versions: PEADM Forge Module versions prior to 3.24.0 Description: A security misconfiguration was discovered in the software. Recommendations: For versions prior to 3.24.0, update to version 3.24.0 or later to resolve the issue...

CVE-2024-9160: Improper Certificate Validation

In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered...

CVE-2024-6592: Missing Authentication for Critical Function

An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway aka Single Sign-On Agent on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected...

CVE-2024-46612

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...

CVE-2024-46612

IceCMS v3.4.7 and before was discovered to contain a hardcoded JWT key, allowing an attacker to forge JWT authentication information...

SAML authentication bypass via Incorrect XPath selector

Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrar...

CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...