CVE-2025-66564 Sigstore Timestamp Authority allocates excessive memory during request parsing

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.0.3, Function api.ParseJSONRequest currently splits via a call to strings.Split an optionally-provided OID which is untrusted data on periods. Similarly, function api.getContentType splits the Content-Type heade...

node-forge ASN.1 OID Integer Truncation

...

CVE-2025-66030 node-forge ASN.1 OID Integer Truncation

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be...

CVE-2025-66030

CVE-2025-66030 (node-forge) is a vulnerability in the Forge/ node-forge TLS implementation for JavaScript. The issue is an integer overflow in versions 1.3.1 and earlier, allowing remote, unauthenticated attackers to craft ASN.1 structures with oversized arcs. These arcs can be decoded as smaller...

EUVD-2025-199768

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be...

node-forge 输入验证错误漏洞

node-forge is a software application. A WebJar for node-forge. An input validation error vulnerability exists in node-forge 1.3.1 and prior versions, which stems from an integer overflow that could allow a remote, unauthenticated attacker to bypass OID-based security decisions...

CVE-2025-65647

Insecure Direct Object Reference IDOR in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter...

CVE-2025-65647

Insecure Direct Object Reference IDOR in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter...

The vulnerability of the asn_build_objid() function in the Squid proxy server allows a hacker to induce a service failure.

The vulnerability of the asnbuildobjid function in the Squid proxy server is related to errors in data boundary checking during the processing of ASN.1-encoded long OID identifiers for SNMP. Exploiting this vulnerability can allow an attacker to cause service failures...

EUVD-2001-1302

Malware in sbrugna...

EUVD-2017-16767

Malware in sbrugna...

EUVD-2019-9171

Malware in sbrugna...

gnutls: Vulnerability in GnuTLS otherName SAN export

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...

EUVD-2025-24231

Malicious code in bioql PyPI...

EUVD-2025-31363

Malicious code in bioql PyPI...

SUSE CVE-2025-59362

Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asnbuildobjid in lib/snmplib/asn1.c...

ALPINE-CVE-2025-59362

Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asnbuildobjid in lib/snmplib/asn1.c...

CVE-2025-59362

The Squid proxy server (versions through 7.1 ) is vulnerable to a flaw in the asn_build_objid function located in lib/snmplib/asn1.c. This issue stems from improper handling of ASN.1 encoding during the processing of long SNMP OIDs, specifically due to errors in data boundary checking . An attack...

gnutls: Vulnerability in GnuTLS otherName SAN export

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...

gnutls: Vulnerability in GnuTLS otherName SAN export

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name SAN entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure on an ASN.1 node it do...