power_analysis

Атака по анализу мощности на RSA Оглавление Оглавление Введение Атаки по анализу мощности RSA: краткое введение Пример RSA Оборудование Измерение мощности: краткое введение Закон Ома Закон напряжения Кирхгофа ЗНК Делитель напряжения Шунтирующий резистор Пример измерения мощности Быстрое возведени...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Arm Mbed TLS prior to version 2.23.0. Due to a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed...

TencentOS Server 3: python-pyasn1 (TSSA-2026:0990)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0990 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2026-47886

Applications evaluating user-supplied Spring Expression Language (SpEL) expressions are vulnerable to a Denial of Service (DoS) attack. The root cause is the use of the power operator (^) with BigDecimal or BigInteger operands and a large exponent value. Affected Spring Framework versions include...

CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-47886 Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions

Applications that evaluate user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack when the power operator ^ is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 -...

CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-59650

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-59650 MTI/A0 DH agreement exponentiates unvalidated peer value

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-59650: Improper Input Validation

In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

AZL-92436 CVE-2026-59886 affecting package python-pyasn1 for versions less than 0.4.8-3

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

CVE-2026-59886 pyasn1: Uncontrolled resource consumption when converting decoded REAL values

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: s390/zcrypt: Fixed a memory leak when CCA cards are used as accelerators. Tests revealed that a memory leak occurs when CCA cards are used as accelerators for clear-key RSA requests ME and CRT. With the latest modifications to...

Malicious code in syntax-exponentiation-operator (npm)

The package 'syntax-exponentiation-operator' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1532 Malicious code in syntax-exponentiation-operator (npm)

The package 'syntax-exponentiation-operator' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious Package

Overview transform-exponentiation-operator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

MAL-2026-665 Malicious code in transform-exponentiation-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b79481ce559cb600cfe4b2897847eb06d38b5cbe4ef456339cbbac7b240e60 The package transform-exponentiation-operator was found to contain malicious code. Source: ghsa-malware...

JLSEC-2025-204 An issue was discovered in Arm Mbed TLS before 2.23.0

An issue was discovered in Arm Mbed TLS before 2.23.0. Because of a side channel in modular exponentiation, an RSA private key used in a secure enclave could be disclosed...

JLSEC-2025-221 Use of a Broken or Risky Cryptographic Algorithm in the function `mbedtls_mpi_exp_mod()` in lignum.c...

Use of a Broken or Risky Cryptographic Algorithm in the function mbedtlsmpiexpmod in lignum.c in Mbed TLS Mbed TLS all versions before 3.0.0, 2.27.0 or 2.16.11 allows attackers with access to precise enough timing and memory access information typically an untrusted operating system attacking a...