292 matches found
PT-2024-25811 · Unknown · Cmsaasstarter
Name of the Vulnerable Software and Affected Versions: CMSaaSStarter versions prior to commit 7904d416d2c72ec75f42fbf51e9e64fa74062ee6 Description: The issue concerns the verification of the user JWT Token on the server session. Recommendations: For versions prior to commit...
CVE-2024-29033 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized access to a JupyterHub. The...
CVE-2024-21491
Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of th...
PT-2024-1615
Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Service Platform affected versions not specified Description The issue is related to incorrect cryptographic signature verification in the FactoryTalk Services Platform, which can allow a remote attacker to gain...
CVE-2024-23680 AWS Encryption SDK for Java Improper Verification of Cryptographic Signature
AWS Encryption SDK for Java versions 2.0.0 to 2.2.0 and less than 1.9.0 incorrectly validates some invalid ECDSA signatures...
SUSE-SU-2023:4796-1 Security update for the Linux Kernel (Live Patch 36 for SLE 15 SP2)
This update for the Linux Kernel 5.3.18-15020024151 fixes several issues. The following security issues were fixed: - CVE-2023-4622: Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation bsc1215442. - CVE-2023-2163...
The vulnerability of the sub_6FC74 function in ASUS RT-AX57 Wi-Fi router’s microprogramming system allows a intruder to execute arbitrary code.
The vulnerability of the sub6FC74 function in ASUS RT-AX57 Wi-Fi routers exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted request to the lanipaddr field...
HP ThinUpdate vulnerable to improper server certificate verification
Overview HP ThinUpdate provided by HP Development Company, L.P. is vulnerable to improper server certificate verification CWE-295. Narumi Hirai of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...
Information disclosure
In NIA0 algorithm in Security Mode Command, there is a possible missing verification incorrect input. This could lead to remote information disclosure no additional execution privileges needed...
PT-2023-26917 · Huawei · Emui +1
Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions. Description: The issue is related to the PMS module, where input parameters are not strictly verified. This can lead to successful exploitation causing...
PT-2023-12611 · Huawei · Emui +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns incomplete read and write permission verification in the GPU module. Successful exploitation may affect service confidentiality,...
Oracle Linux 7 : istio (ELSA-2023-12355)
The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12355 advisory. - CVE-2022-27496 - CVE-2022-27488 - CVE-2022-27493 - CVE-2022-27492 - CVE-2022-27491 - CVE-2022-27487 Tenable has extracted the preceding description...
DEBIAN-CVE-2023-31484
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS...
CVE-2023-29000 Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt file...
SUSE CVE-2009-3766
muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
Design/Logic Flaw
Rejected reason: We were unable to verify this vulnerbility...
CVE-2022-36111 immundb has insufficient verification of data authenticity
immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...
Out-of-bounds
Insufficient verification of missing size check in 'LoadModule' may lead to an out-of-bounds write potentially allowing an attacker with privileges to gain code execution of the OS/kernel by loading a malicious TA...
CVE-2022-23738 Incomplete cache verification issue in GitHub Enterprise Server leading to exposure of private repo files
An improper cache key vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to access private repository files through a public repository. To exploit this, an actor would need to already be authorized on the GitHub Enterprise Server instance, be able to crea...
CVE-2022-41580
The HWKEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access...