Debian DSA-5132-1 : ecdsautils - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5132 advisory. It was discovered that ecdsautils, a collection of ECDSA elliptic curve cryptography CLI tools verified some cryptographic signatures incorrectly: A signature...

CVE-2022-23724: Authentication Bypass Using an Alternate Path or Channel

Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redirecting an authentication flow to a target user. To exploit the vulnerability, must have compromised user credentials...

Bulletproofs 加密问题漏洞

Bulletproofs is a short non-interactive zero-knowledge proof by Benedikt Bünz Personal Developer, USA. Bulletproofs 2017/1066 suffers from a security vulnerability that stems from an insecure implementation of the Fiat-Shamir transformation. An attacker can exploit this vulnerability to forge...

PHP-JWT 安全漏洞

PHP-JWT is a simple library for encoding and decoding JSON web tokens JWT in PHP, compliant with RFC 7519. A security vulnerability exists in Firebase PHP-JWT versions prior to 6.0.0, which allows attackers to forge tokens...

Google Android 数据伪造问题漏洞

Google Android is a Linux-based open source operating system from Google. An elevation of privilege vulnerability exists in Google Android versions prior to 12. The vulnerability stems from an incorrect programmatic call to an advanced local procedure. An attacker could use this vulnerability to...

CVE-2022-24594

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...

Cross Site Request Forgery in concrete5/concrete5

A cross-site request forgery vulnerability exists in Concrete CMS v9 that could allow an attacker to make requests on behalf of other users...

Mageia: Security Advisory (MGASA-2021-0254)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-36294

Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user...

Authentication flaw

Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user...

CVE-2021-36294: Insufficient Entropy

Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote unauthenticated attacker may exploit this vulnerability by forging a cookie to login as any user...

CVE-2021-44531

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

Slackware Linux 14.0 / 14.1 / 14.2 / current wpa_supplicant Multiple Vulnerabilities (SSA:2021-362-01)

The version of wpasupplicant installed on the remote host is prior to 2.9. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2021-362-01 advisory. - hostapd before 2.10 and wpasupplicant before 2.10 allow an incorrect indication of disconnection in certain situations...

CVE-2021-41192

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both that is the same across all installations. In such cases, th...

PYSEC-2021-435

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...

PT-2021-23566 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset affected versions not specified Description: The issue concerns improper output neutralization for logs, allowing an authenticated user to forge log entries or inject malicious content into logs through a specific Apache...

Apache Superset 安全漏洞

A code injection vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, prior to version 1.3.2, which stems from a web-based system or product that does not properly authenticate incoming data. An authenticated attacker could exploi...

CVE-2021-43570

The verify function in the Stark Bank Java ECDSA library ecdsa-java 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

CVE-2021-43568

The verify function in the Stark Bank Elixir ECDSA library ecdsa-elixir 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...

CVE-2021-43572

The verify function in the Stark Bank Python ECDSA library aka starkbank-escada or ecdsa-python before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages...