#cwe-347

共收录 355 条相关情报。

漏洞预警2026-09-16 发布INFO

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm us...

CVE-2026-86109

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures becau

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-15 发布INFO

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enable...

CVE-2026-58200

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payloa

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-11 发布INFO

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary ...

CVE-2026-54248

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and

历史摘要 · 未重新核验 · NVD

#cve #cwe-347 #cwe-501

漏洞预警2026-09-11 发布INFO

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, and triggering the ...

CVE-2026-80469

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypa

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-11 发布INFO

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.

CVE-2026-73784

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-11 发布INFO

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.

CVE-2026-89169

live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .ver

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-10 发布INFO

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid w...

CVE-2026-89086

In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decodi

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-10 发布INFO

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with ...

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-10 发布INFO

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsign...

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-09-10 发布INFO

passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

安全公告2026-09-10 发布INFO

passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowin

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-347

漏洞预警2026-09-08 发布INFO

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-57098

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose infor

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-08 发布INFO

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgrade to resolved maintenance release. Update CommServe and...

CVE-2026-77105

CommServe contained a cryptographic signature verification issue affecting privilege management. Software customers upgr

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-07 发布INFO

When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. T...

CVE-2026-14296

When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

安全公告2026-09-05 发布INFO

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-347 #severity:medium

安全公告2026-09-05 发布INFO

RouterOS does not compare the complete RSA public key when matching an SSH authentication request...

CVE-2026-67276

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-347 #severity:critical

漏洞预警2026-09-05 发布INFO

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting a...

CVE-2026-67278

MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures during X.509 validation. Because its trust store includes

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-05 发布INFO

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the e...

CVE-2026-67276

RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-05 发布HIGH

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the result of PHP's openssl_verify() with a l...

CVE-2026-52767

CVE-2026-52767 是 YesWiki（一个基于 PHP 的 Wiki 系统）中存在的一处签名验证绕过漏洞。受影响版本为 4.6.2 至 4.6.6（不含 4.6.6）。漏洞根因位于 HttpSignatureService::v

历史摘要 · 未重新核验 · NVD

#cve #cwe-347

漏洞预警2026-09-04 发布INFO

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were n...

CVE-2026-85525

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certifica

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-347