26 matches found
PT-2020-19987 · Nextcloud +1 · Nextcloud Server +1
Name of the Vulnerable Software and Affected Versions: Nextcloud Server version 19.0.1 Description: The issue is related to insufficient protection of server-side encryption keys, allowing an attacker to replace the public key and potentially decrypt them later. This could lead to an elevation of...
Code injection
MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the...
Security advisory YSA-2019-02 | Yubico
Who should read this advisory? Customers, IT Managers, or FIPS Crypto Officers who use or manage YubiKey FIPS Series devices. An issue exists in YubiKey FIPS Series devices, versions 4.4.2 and 4.4.4 please note, there is no released firmware version 4.4.3. , where the first set of random values...
password-store -- GPG parsing vulnerabilities
Jason A. Donenfeld reports: Markus Brinkmann discovered that the parsing of gpg command line output with regexes isn't anchored to the beginning of the line, which means an attacker can generate a malicious key that simply has the verification string as part of its username. This has a number of...
Advisory: PGP 7.0 signature verification vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Pretty Good Privacy Severity: Medium to high Impact: Users with write access to signed exported key blocks may replace them with arbitrary keys without any warning being issued upon import of those keys Local: Yes Remote: No though...