2360 matches found
CVE-2022-39250: Key Exchange without Entity Authentication
Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver could interfere with the verification flow between two users, injecting its own cross-signing user identity in place of one o...
CVE-2022-39248: Key Exchange without Entity Authentication
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a sophisticated attacker...
CVE-2022-39246: Key Exchange without Entity Authentication
matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others...
CVE-2022-39255: Key Exchange without Entity Authentication
Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages that legitimately appear to have come from another person, without any indication such as a grey shield. Additionally, a...
CVE-2022-39249: Key Exchange without Entity Authentication
Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be...
The vulnerability of the `kex_method_diffie_hellman_group_exchange_sha256_key_exchange` function in the `kex.c` component of the SSH2 protocol implementation library Libssh2 allows a attacker to access confidential data and also trigger a denial-of-service attack.
The vulnerability of the kexmethoddiffiehellmangroupexchangesha256keyexchange function in the kex.c component of the SSH2 protocol implementation library Libssh2 is related to reading data beyond the allowed buffer size. Exploiting this vulnerability allows an attacker to gain access to...
wolfssl:fuzzer-wolfssh-client: Heap-buffer-overflow in ParseAndVerifyCert
Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5875211156717568 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-client Job Type: libfuzzerasanwolfssl Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address...
CVE-2022-2906 Memory leaks in code handling Diffie-Hellman key exchange via TKEY RRs (OpenSSL 3.0.0+ only)
An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service...
Microsoft Windows Internet Key Exchange Remote Code Execution (CVE-2022-34721)
A remote code execution vulnerability exists in Microsoft Windows Internet Key Exchange protocol. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
ntpsec:FuzzServer: Use-after-poison in ke_next_record
Project: https://gitlab.com/NTPsec/ntpsec.git Detailed Report: https://oss-fuzz.com/testcase?key=5929355863261184 Project: ntpsec Fuzzing Engine: afl Fuzz Target: FuzzServer Job Type: aflasanntpsec Platform Id: linux Crash Type: Use-after-poison READ 2 Crash Address: 0x7f15a00fd00a Crash State:...
The vulnerability in the implementation of the Internet Key Exchange (IKE) protocol in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Internet Key Exchange IKE protocol implementation in Windows operating systems is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted IKEv1 packets...
The vulnerability in the implementation of the Internet Key Exchange (IKE) protocol in Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Internet Key Exchange IKE protocol implementation in Windows operating systems is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted IKEv1 packets...
Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
This months Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in Microsoft Windows that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, Apple has also quashed a pair of...
CVE-2022-34720
Windows Internet Key Exchange IKE Extension Denial of Service Vulnerability...
CVE-2022-34720
Windows Internet Key Exchange IKE Extension Denial of Service Vulnerability...
CVE-2022-34721
Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...
CVE-2022-34721
Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...
CVE-2022-34722
Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...
