13643 matches found
Timing Attacks
github.com/openshift/osin is vulnerable to timing attacks. The vulnerability exists because the ClientSecretMatches function in client.go and CheckClientSecret function in util.go does not compare hashes in constant time, allowing an attacker to progressively use the timing of the request to...
Description of the security update for Excel 2013: January 10, 2023 (KB5002320)
Description of the security update for Excel 2013: January 10, 2023 KB5002320 Summary This security update removes the "temporarily restoring old behavior" mechanism that was introduced in the August 2022 Update KB5017166. Note: To apply this security update, you must have the release version of...
EulerOS Virtualization 2.9.1 : gnutls (EulerOS-SA-2023-1192)
According to the versions of the gnutls packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing...
EulerOS Virtualization 2.9.1 : python-pip (EulerOS-SA-2023-1201)
According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, whic...
Information Disclosure
github.com/aws/aws-sdk-go is vulnerable to information disclosure. The library sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field which could be used to brute force the plaintext, when the hash is readable to the attacker...
EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-1106)
According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...
EulerOS 2.0 SP9 : libxml2 (EulerOS-SA-2023-1130)
According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...
EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-1041)
According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...
EulerOS 2.0 SP11 : libxml2 (EulerOS-SA-2023-1016)
According to the versions of the libxml2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XMLPARSEHUGE parser option enabled, sever...
PT-2025-54079
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ksmbd module related to out-of-bounds access in the decode preauth ctxt function. The issue stems from insufficient boundary checks during the...
XStream can cause Denial of Service via stack overflow
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead...
GHSA-J563-GRX4-PJPV XStream can cause Denial of Service via stack overflow
Impact The vulnerability may allow a remote attacker to terminate the application with a stack overflow error resulting in a denial of service only by manipulating the processed input stream. Patches XStream 1.4.20 handles the stack overflow and raises an InputManipulationException instead...
CVE-2022-4804
creationtimestamp| type| source ---|---|--- 2022-12-28 16:12:19+00:00| seen| https://t.me/cibsecurity/55478 2025-04-10 17:49:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11294...
GHSA-5RHG-XHGR-5HFJ go-saml's XML Digital Signatures use SHA-1
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
go-saml's XML Digital Signatures use SHA-1
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
CVE-2020-36563
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
Input validation
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...
GHSA-6JVC-Q2X7-PCHV AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...
AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field
The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext, if the hash is readable to the attacker. AWS now blocks this metadata field, but older SDK versions still send it...
Use of Weak Hash
XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash collisions depending on their control over the input...