CVE-2024-23342

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

CVE-2024-23342

The CVE-2024-23342 entry concerns the python-ecdsa package (pure-Python ECC implementation) with support for ECDSA/EdDSA/ECDH. Versions 0.18.0 and earlier are vulnerable to the Minerva attack. The available connected documents confirm that the vulnerability is tied to this package and note the ab...

CVE-2024-23342

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

Update of ca-certificates

update to CKBI 2.64 from NSS 3.95 - updated: - Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068" - removed old certificates: - Certificate "E-Tugra Certification Authority" - Certificate "Hongkong Post Root CA 1" - Certificate "Symantec Class 1 Public Primary Certification...

Design/Logic Flaw

Vulnerability in the Oracle iStore product of Oracle E-Business Suite component: ECC. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iStore. Successful attacks require huma...

CVE-2024-20938

The CVE-2024-20938 flaw affects Oracle E-Business Suite’s Oracle iStore component (ECC) in versions 12.2.3–12.2.13. An unauthenticated attacker with network access over HTTP can compromise iStore, with successful attacks requiring user interaction and potentially impacting related products. The i...

java-21-openjdk security and bug fix update

1:21.0.1.0.12-2.0.1 - Add Oracle vendor bug URL 1:21.0.1.0.12-2 - Switch to using portable binaries built on RHEL 7 - Sync the copy of the portable specfile with the RHEL 7 version - Related: RHEL-12997 1:21.0.1.0.12-1 - Update to jdk-21.0.1.0+12 GA - Update release notes to 21.0.1.0+12 - Sync th...

Unbreakable Enterprise kernel security update

5.4.17-2136.325.5 - perf symbols: Symbol lookup with kcore can fail if multiple segments match stext Krister Johansen Orabug: 35905508 - char: misc: Increase the maximum number of dynamic misc devices to 1048448 D Scott Phillips Orabug: 35905508 - perf/arm-cmn: Fix invalid pointer when access dtc...

CVE-2023-22106

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: API. Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterpris...

CVE-2023-22107

Vulnerability CVE-2023-22107 affects Oracle E-Business Suite, Oracle Enterprise Command Center Framework (UI Components) for ECC 8–10. Root cause: insufficient input validation in UI Components allowing unauthenticated network access via HTTP, requiring user interaction to exploit. Impact: unauth...

CVE-2023-22106

CVE-2023-22106 affects Oracle E-Business Suite — Oracle Enterprise Command Center Framework (ECC) API, vulnerable in ECC versions 8, 9, 10. Underlying issue allows a low-privilege, network-accessible attacker over HTTP to access restricted data (confidentiality impact). CVSS 3.1 base score 6.5 (C...

GLSA-202310-02 : NVIDIA Drivers: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202310-02 NVIDIA Drivers: Multiple Vulnerabilities - NVIDIA GPU Display Driver for Windows and Linux, all versions, contains a vulnerability in the kernel mode layer nvlddmkm.sys handler for DxgkDdiEscape or IOCTL in which user-mo...

Google Introduces First Quantum Resilient FIDO2 Security Key Implementation

Google on Tuesday announced the first quantum resilient FIDO2 security key implementation as part of its OpenSK security keys initiative. "This open-source hardware optimized implementation uses a novel ECC/Dilithium hybrid signature schema that benefits from the security of ECC against standard...

Design/Logic Flaw

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common default extension. On successful exploitation, the attacker can read or...

CVE-2023-36922 OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common default extension. On successful exploitation, the attacker can read or...

PT-2023-4087 · Sap · Sap Ecc +1

Name of the Vulnerable Software and Affected Versions: SAP ECC and SAP S/4HANA affected versions not specified Description: The issue is related to a programming error in the function module and report of the IS-OIL component, allowing an authenticated attacker to inject an arbitrary operating...

Criminal secure messaging system takedown: 6500+ arrests and €900 million+ seized

In 2020, we reported on how law enforcement managed to compromise a secure communications system set up by and for criminals. Now, Europol has published a progress report showing the enormous impact the infiltration of the encrypted communications tool EncroChat made. EncroChat, a company based i...

After NetScaler upgrade to 13.1-45.61 Bind commands to SSL service not saved

After NetScaler upgrade to firmware version 13.1-45.61, the bind certkey and ECC curve commands to service/service group/internal services are not saved...

Security Bulletin: Vulnerability in Network Security Services (NSS) affects IBM SAN Volume Controller and Storwize Family (CVE-2015-2730)

Summary There is a vulnerability in Network Security Services NSS that is used by IBM SAN Volume Controller and Storwize Family. These issues were disclosed by Mozilla in July 2015. Vulnerability Details CVEID: CVE-2015-2730 DESCRIPTION: Mozilla Network Security Services NSS before 3.19.1 does no...

Incorrect ECC Calculation

Go is vulnerable to Incorrect ECC Calculation in its crypto/elliptic package. The vulnerability is due to defects in the functions ScalarBaseMult and ScalarMult in p256asm.go and p256ordinv.go files while performing P256 Curve implementation of Elliptic-curve cryptography ECC. The functions do no...