https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:21:24 +0000 https://cve.radiocsirt.org/vuln/certfr-2022-avi-767 certfr-2022-avi-767 https://cve.radiocsirt.org/vuln/certfr-2022-avi-767 https://cve.radiocsirt.org/vuln/cnvd-2022-22656 cnvd-2022-22656 https://cve.radiocsirt.org/vuln/cnvd-2022-22656 https://cve.radiocsirt.org/vuln/euvd-2026-234303 EUVD-2026-234303 https://cve.radiocsirt.org/vuln/euvd-2026-234303 https://cve.radiocsirt.org/vuln/fkie_cve-2022-24773 <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.</p> <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-24773 https://cve.radiocsirt.org/vuln/ghsa-2r2c-g63r-vccr <p><strong>Affected:</strong> npm: node-forge</p> <p>### Impact</p> <p>RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.</p> <p>### Patches</p> <p>The issue has been addressed in `node-forge` `1.3.0`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [forge](https://github.com/digitalbazaar/forge) * Email us at [example email address](mailto:security@digitalbazaar.com)</p> <p><strong>Affected:</strong> npm: node-forge</p> <p>### Impact</p> <p>RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.</p> <p>### Patches</p> <p>The issue has been addressed in `node-forge` `1.3.0`.</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory: * Open an issue in [forge](https://github.com/digitalbazaar/forge) * Email us at [example email address](mailto:security@digitalbazaar.com)</p> https://cve.radiocsirt.org/vuln/ghsa-2r2c-g63r-vccr https://cve.radiocsirt.org/vuln/gsd-2022-24773 gsd-2022-24773 https://cve.radiocsirt.org/vuln/gsd-2022-24773 https://cve.radiocsirt.org/vuln/rhsa-2022:1681 <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> <p>vm2: vulnerable to Sandbox Bypass golang.org/x/crypto: empty plaintext packet causes panic follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak urijs: Authorization Bypass Through User-Controlled Key cross-fetch: Exposure of Private Personal Information to an Unauthorized Actor nconf: Prototype pollution in memory store nats-server: misusing the &#34;dynamically provisioned sandbox accounts&#34; feature authenticated user can obtain the privileges of the System account urijs: Leading white space bypasses protocol validation node-forge: Signature verification leniency in checking `digestAlgorithm` structure can lead to signature forgery node-forge: Signature verification failing to check tailing garbage bytes can lead to signature forgery node-forge: Signature verification leniency in checking `DigestInfo` structure Moment.js: Path traversal in moment.locale</p> https://cve.radiocsirt.org/vuln/rhsa-2022:1681 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24773 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-node-forge, Ubuntu:22.04:LTS: node-node-forge</p> <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: node-node-forge, Ubuntu:22.04:LTS: node-node-forge</p> <p>Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-24773 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0417 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Service Mesh ausnutzen, um Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0417