cipher-base is missing type checks, leading to hash rewind and passing on crafted data

Summary This affects e.g. create-hash and crypto-browserify, so I'll describe the issue against that package Also affects create-hmac and other packages Node.js createHash works only on strings or instances of Buffer, TypedArray, or DataView. Missing input type checks in npm create-hash polyfill ...

Malicious code in passport-hmac-aws4 (npm)

The package passport-hmac-aws4 was found to contain malicious code...

MAL-2025-28900 Malicious code in passport-hmac-aws4 (npm)

The package passport-hmac-aws4 was found to contain malicious code...

RHEL 9 : krb5 (RHSA-2025:13777)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:13777 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending password...

CLSA-2025-1755113592 Fix CVE(s): CVE-2025-3576

SECURITY UPDATE: prevent spoofing vulnerability in GSSAPI-protected messages using RC4-HMAC-MD5 due to weaknesses in MD5 checksum design - debian/patches/CVE-2025-3576: don't issue session keys with deprecated enctypes. Updates tests. - CVE-2025-3576...

Linux Distros Unpatched Vulnerability : CVE-2019-11759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute...

Libtpms contains a possible out-of-bound access and abort due to HMAC signing issue

...

Linux Distros Unpatched Vulnerability : CVE-2024-45157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling...

Linux Distros Unpatched Vulnerability : CVE-2017-17806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HMAC implementation crypto/hmac.c in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing ...

ruby-jwt < v3.0.0.beta1 was discovered to contain weak encryption

ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library. Currently more recent versions of OpenSSL are enforcing some key sizes and those restrictions apply to the users of this gem also."...

RLSA-2025:8411 Moderate: krb5 security update

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the...

CVE-2025-42959

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation...

CVE-2025-42959

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation...

CVE-2025-42959 Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476

An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fully patched, successful exploitation...

CVE-2025-42959

CVE-2025-42959 affects SAP NetWeaver ABAP Server and SAP ABAP Platform. An unauthenticated attacker can reuse an HMAC credential extracted from a system missing a patch to perform a replay attack against another system, potentially leading to complete system compromise impacting confidentiality, ...

PT-2025-28278 · Sap Se · Sap Netweaver App Server Abap & Abap Platform

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code HMAC credential, extracted from a system missing specific security patches, is reused in a repla...

CLSA-2025-1751895517 krb5: Fix of CVE-2025-3576

CVE-2025-3576: possible spoofing of GSSAPI-protected messages using RC4-HMAC-MD5...

CLSA-2025-1751892444 krb5: Fix of CVE-2025-3576

CVE-2025-3576: possible spoofing of GSSAPI-protected messages using RC4-HMAC-MD5...

SAP NetWeaver ABAP Server和SAP ABAP Platform 安全漏洞

SAP NetWeaver ABAP Server and SAP ABAP Platform are both products of SAP, Germany.SAP NetWeaver ABAP Server is a Web application server used as an SAP product.SAP ABAP Platform is an ABAP-based SAP SAP NetWeaver ABAP Server is a Web application server for SAP products. A security vulnerability...

USN-7582-2: Samba regression

USN-7582-1 fixed vulnerabilities in Samba. The update introduced a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Evgeny Legerov discovered that Samba incorrectly handled buffers in certain GSSAPI routines of Heimdal. A remote attacker...