CVE-2022-38691_38692

CVE-2022-38691/38692 persistently boot FDL1/SPL without signature NOTE: first remove sign check of Boot Chain images in FDL1/SPL ​ fdl1 use genfdl1-dl sourcecode ​ spl android 9/10, use genspl-unlock-legacy sourcecode ​ spl android 11+, use genspl-unlock sourcecode ​ windows prebuilt tools can be...

DataEase v2.10.2 - JWT Signature Verification Bypass

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions, the lack of signature verification of JWT tokens allows attackers to forge JWTs, which then allow access to any interface. The...

SimpleHelp <=5.5.15 - OIDC JWT Authentication Bypass

SimpleHelp = 5.5.15 and 6.0 pre-release contain an authentication bypass caused by lack of cryptographic signature verification in OIDC tokens, letting remote unauthenticated attackers gain technician sessions, exploit requires OIDC authentication configured. id: CVE-2026-48558 info: name:...

npq

NPQ Documentation This directory contains comprehensive documentation for the NPQ Node Package Quality security auditing tool. Core Documentation optional-features.md Configuration and usage of optional security features, including recent improvements and bug fixes. age.marshall.md Detailed...

EUVD-2026-89467

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-91191

The Lantronix G520 Series Cellular Gateway is vulnerable to an improper verification of cryptographic signatures in its update mechanism. During boot, the stock done function disables signature verification in the OPKG configuration before restoring packages from an unsigned feed. Furthermore, th...

CVE-2026-100293 Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

CVE-2024-22026

CVE-2024-22026 POC de exploit para CVE-2024-22026 que afecta a Ivanti EPMM "MobileIron Core" CVE-2024-22026 es una vulnerabilidad de escalada de privilegios local en las versiones del servidor Ivanti EPMM anteriormente MobileIron anteriores a 12.1.0.0, 12.0.0.0 y 11.12.0.1. Esta vulnerabilidad...

jwt-key-id-injector

JWT Key ID Injector 简单的 Python 脚本，用于检查假设的 JWT 漏洞。 假设存在一个使用 HS256 算法签名的 JWT 令牌的应用程序。示例如下： eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.zbgd5BNF1cqQprCEqIvBTjSxMS8bDLnJAEwE-0Cxg 上述令牌可解码为以下数据： "alg": "HS256", "typ": "JWT" "sub":...

minisign

Minisign Una herramienta increíblemente sencilla para firmar archivos y verificar firmas. Tabla de contenidos Minisign Tabla de contenidos Descripción general Documentación Instalación Paquetes precompilados Compilación con Zig Compilación con CMake y GCC o Clang Uso Generación de un par de clave...

CVE-2024-42461

ECDSA 和 EDDSA 签名验证问题的解决方案 描述 在 Wycheproof 项目中发现了 ECDSA 和 EDDSA 签名验证的问题。签名解码阶段缺少检查，允许添加或删除零字节，这影响了邮件的发送能力。本次对 signature.js 文件的更新通过验证签名长度解决了这些问题。 安装 1. 克隆仓库： git clone https://github.com/tuusuario/turepositorio.git 2. 进入项目目录： cd turepositorio 3. 安装依赖： npm install 使用 4. 导入 elliptic 库： var elliptic =...

Testability-CVE-2014-1266

TestableSecurity This is a small proof-of-concept that lifts out the vulnerable SSLVerifySignedServerKeyExchange from Apple's libsecurityssl to demonstrate that the signing code is readily unit testable in isolation. While there's been some talk that this bug wasn't easily tested, the code in...

CVE-2026-96760

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760

The Authlib library (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method improperly processes a JSON Serialization JWS object by returning the payload as successfully verified without performing a signature check or requiring a ...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

EUVD-2026-88465

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2026-96760 Authlib library contains a signature‑verification bypass vulnerability

Authlib v1.7.2 and below contains a signature verification bypass vulnerability. The JsonWebSignature.deserializejson method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and without requiring a cryptographic key...

CVE-2024-7479

CVE-2024-7479 TeamViewer 驱动程序安装的签名验证不当 作者：Marcos Accossatto 仅供演示目的。完整利用代码适用于有漏洞的 TeamViewer Windows 版本。 简介 此利用PoC是Pedro Gabaldon 为 CVE-2024-7479 编写的 PoC 的Python实现。 该脚本包含所有用于处理IPC协议以进行利用的类。 最终利用需要将dbutil23.sys 驱动程序和从BYOVDKit项目编译的可执行文件放在与此脚本相同的本地目录中。 此脚本已在 TeamViewer 15.57.5 上测试过。 脚本利用步骤...

CVE-2025-47827

CVE-2025-47827 Proof-of-concept and vulnerability report for CVE-2025-47827. Contents Description Disclosure Impact Detection Mitigation Binaries Proof of Concept Resources Description In IGEL OS before v11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a...

CVE-2020-10759-poc

Resumen Explota CVE-2020-10759: omisión de verificación de firma PGP de fwupd. Consulte https://github.com/justinsteven/advisories/blob/master/2020fwupddanglings3bucketandCVE-2020-10759signatureverificationbypass.md para más detalles. Requisitos Nota: Debe instalar python3-gpg desde el proveedor ...