EUVD-2022-6950

Malicious code in bioql PyPI...

CVE-2025-29775

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. Th...

CVE-2024-40410

Cybele Software Thinfinity Workspace before v7.0.2.113 was discovered to contain a hardcoded cryptographic key used for encryption...

mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines

The Mozilla Foundation Security Advisory describes this flaw as: Calling PK11Encrypt in NSS using CKMCHACHA20 and the same buffer for input and output can result in plaintext on Intel Sandy Bridge and later processors. In Firefox this only affects the QUIC header protection feature when the...

Critical Photon OS Security Update - PHSA-2024-5.0-92-0313

Updates of 'openssl' packages of Photon OS have been released...

EUVD-2024-1373

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

Wind River VxWorks Security Vulnerability

Wind River VxWorks is an operating system from Wind River Systems, Inc. the industry-leading real-time operating system for building embedded devices and systems. A security vulnerability exists in Wind River VxWorks 7 version 22.09, version 23.03, which stems from a memory leak that does not fre...

AZL-47697 CVE-2024-23170 affecting package hvloader for versions less than 1.0.1-6

An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing side channel in RSA private operations. This side channel could be sufficient for a local attacker to recover the plaintext. It requires the attacker to send a large number of messages for decryption, a...

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE

A vulnerability was found in cjose. The cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. The AES GCM decryption routine incorrectly uses the tag length from the actual Authentication Tag provided in the JSON Web Encryption JWE. A fixed length of 16 octets must ...

GHSA-64X4-9HC6-R2H6 Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library

Summary The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. Severity...

UBUNTU-CVE-2022-31085

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 the session files include the LDAP user name and password in clear text if the PHP OpenSSL extension is not installed or encryption is disabled by...

HPESBUX04309 rev.2 - HPE HP-UX Using OpenSSL, Multiple Remote Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Unauthorized Access to Data, Buffer Overflow; Remote: Denial of Service DoS, Unauthorized Access to Data, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX OpenSSL Software prior to A.01.01.01l.001 CVSS...

CLSA-2022-1643914390 Fix of CVE: CVE-2021-4122

CVE-2021-4122: fix possible attacks against data confidentiality through LUKS2 online reencryption extension crash recovery...

GHSA-59G9-7GFX-C72P Infinite loop in Tomcat due to parsing error

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service...

Google Discloses Severe Bug in Libgcrypt Encryption Library—Impacting Many Projects

A "severe" vulnerability in GNU Privacy Guard GnuPG's Libgcrypt encryption software could have allowed an attacker to write arbitrary data to the target machine, potentially leading to remote code execution. The flaw, which affects version 1.9.0 of libgcrypt, was discovered on January 28 by Tavis...

jsrsasign package data forgery issue vulnerability

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A security vulnerability exists in jsrsasign package version 8.0.18 and earlier Node.js. No detailed vulnerability details are provided at this time...

jsrsasign package buffer overflow vulnerability (CNVD-2021-20284)

jsrsasign package is an open source encryption library from the Japanese software developer Kenji Urashima . A security vulnerability exists in jsrsasign package versions prior to 8.0.18 Node.js. An attacker could exploit this vulnerability to cause memory corruption...

Code injection

The encryption library in Cisco IOS Software 15.21T, 15.21T1, and 15.22T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.26, and Cisco IOS in Cisco VPN Services Port Adaptor for...

CVE-2011-4667

The encryption library in Cisco IOS Software 15.21T, 15.21T1, and 15.22T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.26, and Cisco IOS in Cisco VPN Services Port Adaptor for...

codeigniter -- multiple vulnerabilities

The CodeIgniter changelog reports: Fixed a header injection vulnerability in common function setstatusheader under Apache thanks to Guillermo Caminer from Flowgate. Fixed byte-safety issues in Encrypt Library DEPRECATED when mbstring.funcoverload is enabled. Fixed byte-safety issues in Encryption...