Security Bulletin: IBM Security Verify Governance - Identity Manager, Software component has multiple vulnerabilities

Summary Multiple security vulnerabilities have been addressed in IBM Security Verify Governance - Identity Manager, Software component. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the...

Security Bulletin: IBM Db2 and IBM Java SDK used by IBM Security Verify Governance - Identity Manager have multiple vulnerabilities

Summary Information about security vulnerabilities affecting IBM DB2 and IBM Java has been published in security bulletins. IBM Security Verify Governance - Identity Manager ships with IBM DB2 and IBM Java SDK. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

SUSE CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

DEBIAN-CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

CVE-2018-25099

In the CryptX module before 0.062 for Perl, gcmdecryptverify and chacha20poly1305decryptverify do not verify the tag...

LibTomCrypt Security Vulnerability

LibTomCrypt is a modular portable cryptographic tool that focuses on block ciphers, one-way hash functions, linking patterns and pseudo-random number generators for developers. A security vulnerability exists in LibTomCrypt versions prior to 0.062, which stems from a security flaw in the function...

PT-2024-10618

Name of the Vulnerable Software and Affected Versions CryptX versions prior to 0.062 Description The issue concerns the CryptX module for Perl, where the functions gcm decrypt verify and chacha20poly1305 decrypt verify do not verify the tag, potentially leading to security issues. Recommendations...

LibTomCrypt Security Vulnerability

LibTomCrypt is a modular portable cryptographic tool that focuses on block ciphers, one-way hash functions, linking patterns and pseudo-random number generators for developers. A security vulnerability exists in LibTomCrypt versions prior to 0.062, which stems from a security flaw in the function...

The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts stems from lack of access control mechanisms. This allows attackers to exploit the vulnerabilities to disclose protected information.

The vulnerability of the software for automated, cloud-based, and on-premise administration of IBM Security Verify Privilege accounts is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to disclose protected information through a specially...

PT-2024-10411 · Ibm · Ibm Security Directory Integrator +1

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Integrator version 7.2.0 IBM Security Verify Directory Integrator version 10.0.0 Description: The issue is related to the absence of the secure attribute in session cookies, allowing attackers to obtain cookie values by...

[SECURITY] Fedora 40 Update: xmlunit-2.9.0-11.fc40

XMLUnit provides you with the tools to verify the XML you emit is the one you want to create. It provides helpers to validate against an XML Schema, assert the values of XPath queries or compare XML documents against expected outcome s...

CVE-2023-48703 SAML authentication bypass vulnerability in RobotsAndPencils/go-saml

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

BIT-NODE-2020-1971 EDIPARTYNAME NULL pointer dereference

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERALNAMEcmp which compares different instances of a GENERALNAME to see if they are equal or not. This function behaves incorrect...

SUSE CVE-2024-24783

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

IBM Security Verify Privilege On-Premises Information Disclosure Vulnerability

IBM Security Verify Privilege is a solution from International Business Machines IBM that manages and protects user identities and privileges. An information disclosure vulnerability exists in IBM Security Verify Privilege On-Premises version 11.5 and earlier, which stems from the application's...

AZL-37522 CVE-2024-24783 affecting package golang for versions less than 1.21.6-1

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

DEBIAN-CVE-2024-24783

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

CVE-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

CVE-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...

Uncaught Exception

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Uncaught Exception. Go Vulnerability Report: Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify ...