1307 matches found
EUVD-2024-41337
Malicious code in bioql PyPI...
EUVD-2024-41339
Malicious code in bioql PyPI...
EUVD-2023-48021
Malicious code in bioql PyPI...
EUVD-2024-21200
Malicious code in bioql PyPI...
EUVD-2025-22031
Malicious code in bioql PyPI...
EUVD-2025-22035
Malicious code in bioql PyPI...
EUVD-2024-20689
Malicious code in bioql PyPI...
EUVD-2021-30578
Malicious code in bioql PyPI...
EUVD-2025-22030
Malicious code in bioql PyPI...
EUVD-2023-49506
Malicious code in bioql PyPI...
EUVD-2021-32221
Malicious code in bioql PyPI...
Mbed TLS 3.6.4 - Use-After-Free
/ Exploit Title: Mbed TLS 3.6.4 - Use-After-Free Google Dork: N/A Date: 2025-08-29 Exploit Author: Byte Reaper Vendor Homepage: https://github.com/Mbed-TLS/mbedtls Software Link: https://github.com/Mbed-TLS/mbedtls Version: ≤ 3.6.4 Tested on: Kali Linux CVE: CVE-2025-47917 / include include inclu...
An issue was discovered in Mbed TLS before 2.25.0 (and before 2.16.9 LTS and before 2.7.18 LTS). A NULL algorithm parameters entry looks identical to an array of REAL (size zero) and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate should be considered invalid.
...
Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_session() failure.
...
An issue was discovered in Arm Mbed TLS before 2.24.0. mbedtls_x509_crl_parse_der has a buffer over-read (of one byte).
...
In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX.
...
An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_ssl_read to erase unused application data from memory.
...
An issue was discovered in Mbed TLS before 2.28.1 and 3.x before 3.2.0. In some configurations, an unauthenticated attacker can send an invalid ClientHello message to a DTLS server that causes a heap-based buffer over-read of up to 255 bytes. This can cause a server crash or possibly information disclosure based on error responses. Affected configurations have MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE enabled and MBEDTLS_SSL_IN_CONTENT_LEN less than a threshold that depends on the configuration: 258 bytes if using mbedtls_ssl_cookie_check, and possibly up to 571 bytes with a custom cookie check function.
...
Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)
...