3697 matches found
CVE-2022-3927 The affected products store public and private key that are used to sign and protect custom parameter set files from modification.
The affected products store both public and private key that are used to sign and protect Custom Parameter Set CPS file from modification. An attacker that manages to exploit this vulnerability will be able to change the CPS file, sign it so that it is trusted as the legitimate CPS file. This iss...
[SECURITY] [DLA 3249-1] mbedtls security update
Debian LTS Advisory DLA-3249-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany December 26, 2022 https://wiki.debian.org/LTS Package : mbedtls Version : 2.16.9-0deb10u1 CVE ID : CVE-2019-16910 CVE-2019-18222 CVE-2020-10932 CVE-2020-10941 CVE-2020-16150...
The owner can swap the proxy implementation with a malicious one
Lines of code Vulnerability details The owner of VRFNFTRandomDrawFactory.sol could swap the current implementation with a malicious one at any moment, without a waiting period. Impact The worse case scenario is one in which the private key of the contract owner gets stolen. In this case the owner...
CVE-2022-46392
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
DEBIAN-CVE-2022-46392
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
Design/Logic Flaw
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
UBUNTU-CVE-2022-46392
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
CVE-2022-46392
CVE-2022-46392 affects Mbed TLS 2.28.2 and 3.x prior to 3.3.0. An adversary with precise memory-access information (e.g., untrusted OS vs. secure enclave) can recover an RSA private key after a single private-key operation when MBEDTLS_MPI_WINDOW_SIZE is 3 or smaller. Debian/Siemens and related a...
PT-2022-27849
Name of the Vulnerable Software and Affected Versions Mbed TLS versions prior to 2.28.2 Mbed TLS versions 3.x prior to 3.3.0 Description An issue allows an adversary with access to precise enough information about memory accesses to recover an RSA private key after observing the victim performing...
CVE-2022-46392
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
CVE-2022-46392
An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses typically, an untrusted operating system attacking a secure enclave can recover an RSA private key after observing the victim performing a single...
Contec CONPROSYS HMI System 安全漏洞
Contec CONPROSYS HMI System is an HTML5 technology-based HMI Human Machine Interface/SCADA Supervisory Control and Data Acquisition software product from Contec Japan. A security vulnerability exists in CONPROSYS HMI System CHS, which originates from improper access control, and can be exploited ...
mina-sshd: Java unsafe deserialization vulnerability
A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server...
python-paramiko: Race condition in the write_private_key_file function
A race condition was found in Paramiko. This flaw allows unauthorized information disclosure from an attacker with access to the writeprivatekeyfile...
python-paramiko: Race condition in the write_private_key_file function
A race condition was found in Paramiko. This flaw allows unauthorized information disclosure from an attacker with access to the writeprivatekeyfile...
GHSA-FHW8-8J55-VWGQ Unsafe deserialization in Apache MINA SSHD
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...
CVE-2022-45047
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD = 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys ...
GSD-2022-1007255 crypto: akcipher - default implementation for setting a private key
crypto: akcipher - default implementation for setting a private key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.150 by commit...
GSD-2022-1007052 crypto: akcipher - default implementation for setting a private key
crypto: akcipher - default implementation for setting a private key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.75 by commit...
GSD-2022-1006789 crypto: akcipher - default implementation for setting a private key
crypto: akcipher - default implementation for setting a private key This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...