Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openpgp vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2001-0381
The OpenPGP PGP standard allows an malicious user to determine the private signature key via a cryptanalytic attack in which the attacker alters the encrypted private key file and captures a single message signed with the signature key.
Pgp Openpgp
8.8
CVSSv3
CVE-2015-3298
Yubico ykneo-openpgp prior to 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.
Yubico Ykneo-openpgp
1 Github repository
7.5
CVSSv3
CVE-2018-12019
The signature verification routine in Enigmail prior to 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote malicious users to spoof arbitrary email signatures via public keys containing ...
Enigmail Enigmail
5.9
CVSSv3
CVE-2018-12556
The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote malicious user...
Yarnpkg Website
5.9
CVSSv3
CVE-2019-8338
The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and previous versions, does not verify the status of the signature at all, which allows remote malicious users to spoof arbitrary email signatures by crafting a signed email with an invalid signatu...
Gpg-pgp Project Gpg-pgp
7.5
CVSSv3
CVE-2017-17848
An issue exists in Enigmail prior to 1.9.9. In a variant of CVE-2017-17847, signature spoofing is possible for multipart/related messages because a signed message part can be referenced with a cid: URI but not actually displayed. In other words, the entire containing message appe...
Enigmail Enigmail
Debian Debian Linux 7.0
Debian Debian Linux 8.0
Debian Debian Linux 9.0
6.5
CVSSv3
CVE-2018-15586
Enigmail prior to 2.0.6 is prone to to OpenPGP signatures being spoofed for arbitrary messages using a PGP/INLINE signature wrapped within a specially crafted multipart HTML email.
Enigmail Enigmail
7.5
CVSSv3
CVE-2018-15588
MailMate prior to 1.11.3 mishandles a suspicious HTML/MIME structure in a signed/encrypted email.
Freron Mailmate
7.5
CVSSv3
CVE-2017-9604
KDE kmail prior to 5.5.2 and messagelib prior to 5.5.2, as distributed in KDE Applications prior to 17.04.2, do not ensure that a plugin's sign/encrypt action occurs during use of the Send Later feature, which allows remote malicious users to obtain sensitive information by ...
Kde Messagelib
Kde Kmail
NA
CVE-2005-0366
The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote malicious users to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or...
Gnupg Gnupg
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4654
CVE-2023-49606
encryption
NULL pointer dereference
CVE-2024-4439
CVE-2024-4649
race condition
CVE-2024-27202
CVE-2024-34566
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
6
NEXT »