3472 matches found
wolfCrypt leaks cryptographic information via timing side channel
wolfSSL and wolfCrypt 4.0.0 and earlier when configured without --enable-fpecc, --enable-sp, or --enable-sp-math contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about th...
Jenkins Amazon EC2 Plugin leaked beginning of private key in system log
Jenkins Amazon EC2 Plugin printed a log message that contained the beginning of the private key to the Jenkins system log. The log message no longer includes the beginning of the private key...
GHSA-W7FV-7J46-WWRV Jenkins Amazon EC2 Plugin leaked beginning of private key in system log
Jenkins Amazon EC2 Plugin printed a log message that contained the beginning of the private key to the Jenkins system log. The log message no longer includes the beginning of the private key...
UBUNTU-CVE-2022-29222
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection...
Zend Framework Information Disclosure
Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key...
GHSA-CGHG-JCV6-4V5M Jenkins Coverity Plugin has Insufficiently Protected Credentials
A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser e.g. malicious extension to retrieve the configured keystore and priva...
GHSA-FQW7-C6VR-Q29M openstack-mistral Discloses the presence of arbitrary files within the filesystem
A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh privatekeyfilename can take an absolute path, it can be used to...
Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...
GHSA-JFXM-W8G2-4RCV Cisco node-jose improper validation of JWT signature
A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON Web Tokens JWTs...
Private key stored in plain text by Jenkins Google Compute Engine Plugin
Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system...
The vulnerability of the function of the NextCloud clipboard synchronization tool, which allows a hacker to gain access to confidential data.
The vulnerability of the function of the client-side encryption tool for Nextcloud’s desktop synchronization platform relates to the lack of verification of the ownership of the private key of previously uploaded public certificates. Exploiting this vulnerability allows a malicious actor to gain...
USN-5351-2 paramiko vulnerability
USN-5351-1 fixed a vulnerability in Paramiko. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Jan Schejbal discovered that Paramiko incorrectly handled permissions when writing private key files. A local attacker could possibly use this issue to gain...
CVE-2022-26252
aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain the root user private SSH keyidrsa...
aaPanel 路径遍历漏洞
aaPanel is an open source hosting control panel. A security vulnerability exists in aaPanel v6.8.21 that allows an attacker to obtain the root user's private SSH key idrsa...
bouncycastle: Timing issue within the EC math library
A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...
bouncycastle: Timing issue within the EC math library
A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...
GHSA-F8Q4-JWWW-X3WV Race Condition in Paramiko
In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure...
DEBIAN-CVE-2022-24302
In Paramiko before 2.10.1, a race condition between creation and chmod in the writeprivatekeyfile function could allow unauthorized information disclosure...
