#cwe-347

共收录 355 条相关情报。

漏洞预警2026-07-27 发布INFO

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification...

CVE-2026-14837

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-22 发布INFO

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an a...

CVE-2026-13089

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorith

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-22 发布INFO

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify

CVE-2026-13089

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorith

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-22 发布INFO

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 t...

CVE-2026-10723

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMA

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-20 发布INFO

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

CVE-2026-47304

## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #nuget #cwe-345 #cwe-347 #severity:high

漏洞预警2026-07-20 发布INFO

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verifier accepts any non-empty string as v...

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-20 发布INFO

Network-AI before 5.13.4 Cryptographic Signature Verification Bypass

CVE-2026-64623

Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-17 发布INFO

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransparencyLog(N>1) or WithSignedCertificateTimestamps(N>1) co...

CVE-2026-49834

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransp

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-17 发布INFO

sigstore-go: Multi-log threshold bypass via single compromised log

CVE-2026-49834

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.0, a verifier configured with WithTransp

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-16 发布INFO

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verif...

CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verif

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-16 发布INFO

Centrifugo: Dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass

CVE-2026-49998

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verif

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-16 发布INFO

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizati...

CVE-2026-45795

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server ac

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-16 发布INFO

Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

CVE-2026-45795

The Janssen Project is an open-source identity and access management (IAM) platform. Prior to 2.0.0, jans-auth-server ac

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-16 发布INFO

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft...

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration fo

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-16 发布INFO

moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint

CVE-2026-54733

The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration fo

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-07-16 发布INFO

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4....

CVE-2026-15013

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algor

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-15 发布INFO

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling can let TokenFilter#doFilter() pass X-DE-TOKEN values to To...

CVE-2026-46684

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase enterprise token handling ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-14 发布INFO

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the p...

CVE-2026-48815

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certifi

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-07-14 发布INFO

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when...

CVE-2026-48758

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding fu

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-07-14 发布INFO

sigstore-js: DSSE payloadType type-binding failure

CVE-2026-48758

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding fu

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347