GitLab: Bypass Email Verification -- Able to Access Internal Gitlab Services that use Login with Gitlab and Perform Check on email domain

Summary Hi, I found the new SCIM provisioning function allows any group owner in gitlab to create any user with verified email address. i.e. I can create user with email address [email protected], and gitlab.com will think [email protected] is verified already. This will bring problem to the clie...

Signature Verification Bypass

Linux kernel is vulnerable to signature validation bypass attacks. This is because the root can gain direct access to an internal keyring, such as '.dnsresolver' in RHEL-7 or '.builtintrustedkeys' upstream, by joining it as its session keyring.Root user could bypass module signature verification ...

Signature Verification Bypass

Overview Versions of jwt-simple prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the decode function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 symmetric algorithm JWT with the server's...

ALPINE-CVE-2019-0215

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions...

Foxit Reader and PhantomPDF for Windows Validation Bypass Vulnerability

Foxit Reader for Windows is China's Foxit Foxit software company's a Windows-based platform for PDF document reader. PhantomPDF for Windows is its commercial version. A security vulnerability exists in Foxit Reader 9.3.0.10826 and earlier versions and PhantomPDF 9.3.0.10826 and earlier versions f...

WordPress 3.7.x < 3.7.28 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Authors could alter meta data to delete files that they weren't authorized to. - Authors could create posts of unauthorized types with specially crafted input. -...

WordPress 4.3.x < 4.3.18 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Authors could alter meta data to delete files that they weren't authorized to. - Authors could create posts of unauthorized types with specially crafted input. -...

WordPress 4.9.x < 4.9.9 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Authors could alter meta data to delete files that they weren't authorized to. - Authors could create posts of unauthorized types with specially crafted input. -...

WordPress 4.8.x < 4.8.8 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Authors could alter meta data to delete files that they weren't authorized to. - Authors could create posts of unauthorized types with specially crafted input. -...

GHSA-QCJ7-G2J5-G7R3 In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification

In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of...

Verification Bypass in jsonwebtoken

Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

GHSA-C7HR-J4MJ-J2W6 Verification Bypass in jsonwebtoken

Versions 4.2.1 and earlier of jsonwebtoken are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm. Recommendation Update to version 4.2.2 or later...

Cisco IOS XE Software Digital Signature Authentication Bypass Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A digital signature verification bypass vulnerability exists in the Image Verification feature of Cisco IOS XE Software, which arises from a failure of the affected software to properly verify the electronic...

CVE-2018-15374 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image or file on an affected device. The vulnerability is due to the affected software improperly verifying digital signatures for software image...

ANA App for iOS fails to verify SSL server certificates

Overview ANA App for iOS provided by ALL NIPPON AIRWAYS CO., LTD fails to verify SSL server certificates CWE-295. Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact...

PYSEC-2018-150

Hyperledger Iroha versions v1.0beta and v1.0.0beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes...

Design/Logic Flaw

In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key RS/ES family of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm HS family...

PT-2018-4549

Name of the Vulnerable Software and Affected Versions jsonwebtoken versions 4.2.1 and earlier Description The issue allows an attacker to bypass verification when a token digitally signed with an asymmetric key is sent, but the attacker instead sends a token digitally signed with a symmetric...

CVE-2018-0227

A vulnerability in the Secure Sockets Layer SSL Virtual Private Network VPN Client Certificate Authentication feature for Cisco Adaptive Security Appliance ASA could allow an unauthenticated, remote attacker to establish an SSL VPN connection and bypass certain SSL certificate verification steps...

The vulnerability of the NX-OS operating system of the Cisco Unified Computing System Central device management system is related to incorrect verification of the cryptographic signature of data. This allows a perpetrator to bypass the signature verification during the loading of updates.

The vulnerability of the NX-OS operating system of the Cisco Unified Computing System Central device management system is related to incorrect verification of the cryptographic signature of data. Exploiting this vulnerability could allow an attacker to bypass the signature verification and downlo...