357 matches found
PT-2026-7119
DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack...
Silicon Labs Series 2 security vulnerabilities
Silicon Labs Series 2 is an IoT system platform developed by Silicon Corporation in the United States. There is a security vulnerability in Silicon Labs Series 2, which stems from the fact that the DPA counter does not reseed under certain conditions, potentially allowing key extraction through D...
CVE-2025-7432: Insufficient Entropy
DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack...
CVE-2026-23892
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a theoretical timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the firs...
CVE-2026-23892 OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a theoretical timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the firs...
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
Impact OctoPrint versions up to and including 1.11.5 are affected by a theoretical timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the first mismatched character during API key validation, rather than a...
CVE-2026-23892: Observable Timing Discrepancy
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a theoretical timing attack vulnerability that allows API key extraction over the network. Due to using character based comparison that short-circuits on the firs...
MiracleLinux 7 : nspr-4.21.0-1.el7, nss-util-3.44.0-3.el7, nss-softokn-3.44.0-5.el7, nss-3.44.0-4.el7 (AXSA:2019-4268:01)
The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4268:01 advisory. ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 nss: Cache side-channel variant of the Bleichenbacher attack...
MiracleLinux 7 : golang-1.8.3-1.el7 (AXSA:2017-2315:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2315:02 advisory. A carry propagation flaw was found in the implementation of the P-256 elliptic curve in golang. An attacker could possibly use this flaw to extract private...
MiracleLinux 3 : gnupg-1.4.5-18.AXS3.1 (AXSA:2014-247:01)
The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2014-247:01 advisory. GnuPG GNU Privacy Guard is a GNU utility for encrypting data and creating digital signatures. GnuPG has advanced key management capabilities and is compliant...
Application-Specific Power Side-Channel Attacks and Countermeasures: A Survey
Side-channel attacks try to extract secret information from a system by analyzing different side-channel signatures, such as power consumption, electromagnetic emanation, thermal dissipation, acoustics, time, etc. Power-based side-channel attack is one of the most prominent side-channel attacks i...
CVE-2025-63729
An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO3.7L3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder...
JLSEC-2025-228 Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations...
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...
PT-2025-48526
Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery...
Gallagher HBUS Devices security vulnerabilities
Gallagher HBUS Devices is a family of access control and alarm peripheral devices from Gallagher New Zealand. A security vulnerability exists in Gallagher HBUS Devices that stems from an observable timing difference that could lead to the extraction of device-specific keys...
CVE-2025-41722
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...
CVE-2025-41722: Use of Hard-coded Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...
EUVD-2017-5215
Malware in sbrugna...