7256 matches found
Denial Of Service (DOS)
jwcrypto is vulnerable to Denial Of Service DoS. The vulnerability is due to a missing upper bound check in the p2c header value PBES2 count which contains the PBKDF2 iteration count used in the PBKDF2 cryptographic key derivation function. The unbounded value can be exploited by an attacker to...
DoS with algorithms that use PBKDF2 due to unbounded PBES2 Count value
Impact Denial of Service, Applications that allow the use of the PBKDF2 algorithm. Patches A patch is available that sets the maximum number of default rounds. Workarounds Applications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list. Applicatio...
CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-51775
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-50658
The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-51775
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
CVE-2023-50658
CVE-2023-50658 affects the jose2go Go package before 1.6.0, where processing a large PBES2 Count (p2c) value can trigger a denial-of-service via CPU exhaustion. Affected component: jose2go (Go) prior to 1.6.0. Root cause: large p2c value enables resource consumption leading to DoS. Impact: CPU us...
CVE-2023-51775
The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service CPU consumption via a large p2c aka PBES2 Count value...
PT-2023-31606 · Jose2Go +2 · Jose2Go +2
Name of the Vulnerable Software and Affected Versions: jose2go versions prior to 1.6.0 Description: The issue allows attackers to cause a denial of service, specifically CPU consumption, via a large p2c also known as PBES2 Count value in a PBES2 encrypted JWE blob. This can occur when an...
Low: vim
Issue Overview: Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the application has not been shown to be viable. This issue has been addressed in commit 25aabc2b which has been included in...
UBUNTU-CVE-2023-49991
Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c...
Users can unwrap assets in batches and avoid paying fees to protocol
Lines of code Vulnerability details Impact Users can unwrap their assets from The Ocean and evade paying fees to the protocol when the requested amount is smaller than the fee divisor. This happens due to a truncation of the result in the fee calculation. Proof of Concept This affects the...
jose4j: Insecure iteration count setting
A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...
jose4j: Insecure iteration count setting
A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...
jose4j: Insecure iteration count setting
A flaw was found in Jose4J which allows a malicious user or internal person to erroneously set a low iteration count of 1000 or less to secure the Json Web Token. This could apply to lack of entropy and leave the system less secure...
GHSA-7F9X-GW85-8GRF lestrrat-go/jwx's malicious parameters in JWE can cause a DOS
Summary too high p2c parameter in JWE's alg PBES2- could lead to a DOS attack Details The JWE key management algorithms based on PBKDF2 require a JOSE Header Parameter called p2c PBES2 Count. This parameter dictates the number of PBKDF2 iterations needed to derive a CEK wrapping key. Its primary...
CVE-2023-5141
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the insertedcount parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...