1794 matches found
GO-2022-0187 Incorrect computation for P-256 curves in crypto/elliptic
The ScalarMult implementation of curve P-256 for amd64 architectures generates incorrect results for certain specific input points. An adaptive attack can progressively extract the scalar input to ScalarMult by submitting crafted points and observing failures to derive correct output. This leads ...
GSD-2022-1003991 nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags
nvme-pci: fix a NULL pointer dereference in nvmeallocadmintags This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.283 by commit...
validate-data denial-of-service vulnerability (CNVD-2022-66399)
validate-data is a NodeJs backend library by Anoop P R Individual Developer. It is used to validate data according to the provided rules. A denial of service vulnerability exists in validate-data version v0.1.1, which stems from not properly handling incoming error messages and can be exploited b...
PT-2022-3157 · Emerson · Emerson Deltav Distributed Control System
Name of the Vulnerable Software and Affected Versions: Emerson DeltaV Distributed Control System DCS controllers and IO cards through 2022-04-29 Description: The issue is related to the misuse of passwords and the presence of hardcoded credentials in the FTP service of the Emerson DeltaV...
EulerOS 2.0 SP8 : golang (EulerOS-SA-2022-1930)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data. CVE-2022-24675 - The gener...
Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2022-1890)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle Linux 8 : go-toolset:ol8addon (ELSA-2022-14844)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-14844 advisory. go-toolset 1.17.10-1 - Set version to correspond to the matching build golang version - delve can be now added to aarch64 as well, remove ifarch. gola...
p-nintendo.com Cross Site Scripting vulnerability OBB-2627700
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GO-2022-0217 Denial of service affecting P-521 and P-384 curves in crypto/elliptic
A DoS vulnerability in the crypto/elliptic implementations of the P-521 and P-384 elliptic curves may let an attacker craft inputs that consume excessive amounts of CPU. These inputs might be delivered via TLS handshakes, X.509 certificates, JWT tokens, ECDH shares or ECDSA signatures. In some...
GO-2022-0435 Panic due to large inputs affecting P-256 curves in crypto/elliptic
A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or P256.ScalarBaseMult to panic. Indirect uses through crypto/ecdsa and crypto/tls are unaffected. amd64, arm64, ppc64le, and s390x are unaffected...
Updated golang packages fix security vulnerability
encoding/pem: fix stack overflow in Decode. A large more than 5 MB PEM input can cause a stack overflow in Decode, leading the program to crash CVE-2022-24675 crypto/elliptic: tolerate all oversized scalars in generic P-256. A crafted scalar input longer than 32 bytes can cause P256.ScalarMult or...
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input.
...
SUSE SLED15 / SLES15 Security Update : go1.18 (SUSE-SU-2022:1410-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1410-1 advisory. - encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of...
SUSE: Security Advisory (SUSE-SU-2022:1411-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GSD-2022-1001243 Bluetooth: hci_serdev: call init_rwsem() before p->open()
Bluetooth: hciserdev: call initrwsem before p-open This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.2 by commit...
AZL-9547 CVE-2022-28327 affecting package golang for versions less than 1.18.3-1
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...
Input validation
The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar input...
webTareas SQL注入漏洞
webTareas is a web-based open source collaboration tool. The product supports project management, bug tracking, content management and meeting management. A SQL injection vulnerability exists in webTareas version 2.4p3 and earlier versions, which stems from the $uq parameter of...
