CVE-2019-15651

wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASNBOOLEAN byte is mishandled for a crafted DER certificate in GetLengthex...

CVE-2019-15651: Out-of-bounds Read

wolfSSL 4.1.0 has a one-byte heap-based buffer over-read in DecodeCertExtensions in wolfcrypt/src/asn.c because reading the ASNBOOLEAN byte is mishandled for a crafted DER certificate in GetLengthex...

RUSTSEC-2019-0007 Processing of maliciously crafted length fields causes memory allocation SIGABRTs

Affected versions of this crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks. This allows an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide. The flaw w...

Processing of maliciously crafted length fields causes memory allocation SIGABRTs

Affected versions of this crate tried to preallocate a vector for an arbitrary amount of bytes announced by the ASN.1-DER length field without further checks. This allows an attacker to trigger a SIGABRT by creating length fields that announce more bytes than the allocator can provide. The flaw w...

Improper Access Control

Oracle Java SE is vulnerable to Improper Access Control vulnerability. This is because the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash Vulnerability

NSS suffers from a NULL dereference issue when parsing Netscape Certificate Sequences in CERTDecodeCertPackage. nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple...

NSS Netscape Certificate Sequences CERT_DecodeCertPackage() Crash

nss: CERTDecodeCertPackage crash with Netscape Certificate Sequences I noticed that the main entrypoint for decoding DER blobs in NSS, CERTDecodeCertPackage, actually handles multiple formats including PEM, PKCS7, and old Netscape Certificate Sequences. You can generate a Netscape Certificate...

Denial Of Service (DoS)

libtasn1.so is vulnerable to denial of service DoS. The attack exists because it allows a two-byte stack overflow while decoding DER encoded data in asn1derdecoding, leading to the DoS attack and possibly other attacks...

der-apokryphe-orden.de XSS vulnerability

Open Bug Bounty ID: OBB-697377 Description| Value ---|--- Affected Website:| der-apokryphe-orden.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Debian: Security Advisory (DLA-1560-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

der-hundecoach.de XSS vulnerability

Open Bug Bounty ID: OBB-686107 Description| Value ---|--- Affected Website:| der-hundecoach.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| hidde...

der-takt.de XSS vulnerability

Open Bug Bounty ID: OBB-648167 Description| Value ---|--- Affected Website:| der-takt.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

der-betze-brennt.de XSS vulnerability

Open Bug Bounty ID: OBB-639508 Description| Value ---|--- Affected Website:| der-betze-brennt.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

praxis-an-der-lauter.de XSS vulnerability

Open Bug Bounty ID: OBB-637438 Description| Value ---|--- Affected Website:| praxis-an-der-lauter.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lexikon-der-schaedlinge.de XSS vulnerability

Open Bug Bounty ID: OBB-628719 Description| Value ---|--- Affected Website:| lexikon-der-schaedlinge.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387)

It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER...

van-der-waal-vof.hondagroendealers.nl XSS vulnerability

Open Bug Bounty ID: OBB-626626 Description| Value ---|--- Affected Website:| van-der-waal-vof.hondagroendealers.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score...

Denial Of Service (DoS)

libtasn1.so is vulnerable to denial of service DoS. The attack exists because it allows a two-byte stack overflow while decoding DER encoded data in asn1derdecoding, leading to the DoS attack and possibly other attacks...

OpenJDK: DerValue unbounded memory allocation (Libraries, 8182387)

It was discovered that the Libraries component of OpenJDK failed to sufficiently limit the amount of memory allocated when reading DER encoded input. A remote attacker could possibly use this flaw to make a Java application use an excessive amount of memory if it parsed attacker supplied DER...

der-winzer.at XSS vulnerability

Open Bug Bounty ID: OBB-607664 Description| Value ---|--- Affected Website:| der-winzer.at Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...