Digital-Signature-Forgery-Attack

In this article, we will look at the cryptographic attack of digital signature forgery Digital Signature Forgery Attack, its consequences pose a threat to the security of transactions in the Bitcoin network, since digital signatures confirm the ownership and authorization of cryptocurrency...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

CVE-2026-22001-SPHINCS-WOTS-Weak-Randomness-Forgeable-Signature

CVE-2026-22001 – SPHINCS+ WOTS+ Weak Randomness Signature Forgery Overview An implementation of the SPHINCS+ post‑quantum signature scheme uses a flawed random number generator during WOTS+ signature generation. The same nonce k is reused across multiple signatures, allowing an attacker to recove...

CVE-2026-0265-check

CVE-2026-0265 Vulnerability Assessment Tool Safely determine whether a Palo Alto Networks PAN-OS GlobalProtect portal is vulnerable to CVE-2026-0265 without authenticating any session or modifying any state. Description CVE-2026-0265 is a remote authentication bypass affecting PAN-OS and Panorama...

CVE-2026-13257

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to forge signature requests due to improper verification of data authenticity...

CVE-2022-21449

CVE-2022-21449 repositorio que muestra la generación de una firma base64 para aplicaciones vulnerables a "firmas psíquicas en java", implementado en un entorno nodejs 😅 Antes de ejecutar, asegúrate de instalar el fork modificado de elliptic desde https://github.com/davwwwx/elliptic $ npm install...

Astra Linux – Vulnerability in node-browserify-sign

“browserify-sign” is a package that duplicates the functionality of Node’s crypto public key functions. Much of this functionality is based on Fedor Indutny’s work on “indutny/tls.js”. There is a issue with upper-bound checking in the “dsaVerify” function, which allows an attacker to create...

Astra Linux – Vulnerability in poppler, poppler-22

NSSCryptoSignBackend.cc in Poppler before version 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, which can lead to potential signature forgeries...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports digital signatures for ODF documents and macros within documents. It provides visual indicators that confirm that the document has not been altered since the last signature, and that the signature is valid. A vulnerability in certificate validation in LibreOffice allowed...

Astra Linux – Vulnerability in gnupg2

GnuPG versions up to 2.3.6 allow for signature forgery in unusual situations where an attacker possesses secret-key information from a victim’s keyring, and other constraints such as the use of GPGME are met. This can be achieved by injecting malicious data into the command line’s status line...

AlmaLinux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1784038553)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784038553 advisory. - NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential...

Rocky Linux 9.6 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.6:CLSA-2026:1784038553)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784038553 advisory. - NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential...

AlmaLinux 9.2 [TuxCare] Security Update: poppler / poppler-cpp / poppler-cpp-devel / poppler-devel / etc (ALMALINUX9.2:CLSA-2026:1784899428)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784899428 advisory. - NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where a public JWK container such as a JWK Set with a kty member nested inside a JSON array o...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ispemformat in jwt/utils.py, which fails to recognize certain loader-accepted PEM formatting variants as valid PEM. The fix for...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs

Summary IBM DataPower Gateway has addressed multiple vulnerabilities versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-16177 DESCRIPTION: IBM DataPower Gateway could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read...

librenswan: IKEv1 Denial of Service via RSA-SHA1 (PKCS#1 Version 1.5 Encrypted) authentication payload

A flaw was found in Libreswan's implementation of IKEv1 authentication via raw RSA signatures. When processing an IKEv1 packet using PKCS 1 v1.5 RSA encryption, the RSAauthenticatehashsignaturerawrsa function fails to properly validate the length of the authentication hash. A remote,...

EUVD-2026-84946

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...

CVE-2026-18152 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures...