[ASA-202006-1] firefox: multiple issues

Arch Linux Security Advisory ASA-202006-1 ========================================= Severity: High Date : 2020-06-02 CVE-ID : CVE-2020-12399 CVE-2020-12405 CVE-2020-12406 CVE-2020-12407 CVE-2020-12408 CVE-2020-12409 CVE-2020-12410 CVE-2020-12411 Package : firefox Type : multiple issues Remote : Y...

GHSA-42F2-F9VC-6365 Private key leak in Apache CXF

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...

Private key leak in Apache CXF

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...

CVE-2020-12399

A flaw was found in the DSA signature generation function in nss. During the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key. The highest threat from this...

Kubernetes: Private RSA key and Server key exposed on the GitHub repository

Report Submission Form Summary: I was searching for sensitive data in Kubernetes repository where I found these private keys. These are private RSA key and private server key, which could be used for unauthorized access. Steps To Reproduce: VISIT THESE LINKS Repository : kubernetes / kubernetes...

Open Ticket Request System Information Disclosure Vulnerability (CNVD-2020-32426)

Open Ticket Request System OTRS is an open source defect tracking and management system software from the German OTRS Group. The software categorizes service requests submitted through various channels such as phone calls, emails, etc. into different queues and service levels, and the service...

DEBIAN-CVE-2020-1774

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects OTRS Community Edition: 5.0.42 and prior versions, 6.0.27 and prio...

UBUNTU-CVE-2020-1774

When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects OTRS Community Edition: 5.0.42 and prior versions, 6.0.27 and prio...

PT-2020-15051 · Otrs +1 · Otrs +2

Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions prior to 5.0.42 OTRS Community Edition versions prior to 6.0.27 OTRS versions prior to 7.0.16 Description: The issue arises when a user downloads PGP or S/MIME keys/certificates, and the exported file has the...

Security Bulletin: OpenSSL vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera Desktop Client 3.9.1 and earlier (CVE-2018-0734)

Summary The OpenSSL vulnerabilities CVE-2018-0734 impact Aspera High-Speed Transfer Server 3.9.1 and earlier, Aspera Desktop Client 3.9.1 and earlier. The fix is delivered in Aspera High-Speed Transfer Server 3.9.3, Aspera Desktop Client 3.9.3. Vulnerability Details CVEID: CVE-2018-0734...

ARM mbed TLS Encryption Issue Vulnerability

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption capabilities for mbed products. A cryptographic issue vulnerability exists in Arm Mbed TLS versions prior to 2.16.6 and 2.7.x versions prior to 2.7.15. An attacker could exploit this vulnerability to recover a...

Design/Logic Flaw

NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security TLS certificate private key disclosure...

CVE-2020-11792

NETGEAR R8900, R9000, RAX120, and XR700 devices before 2020-01-20 are affected by Transport Layer Security TLS certificate private key disclosure...

CVE-2020-11792

CVE-2020-11792 affects NETGEAR devices: R8900, R9000, RAX120, and XR700 released before 2020-01-20, where the TLS certificate private key disclosure vulnerability exists. The root cause is disclosure of the TLS private key; no concrete exploit details are provided in the supplied documents. There...

CVE-2020-10932

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...

CVE-2020-10932

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...

Design/Logic Flaw

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...

UBUNTU-CVE-2020-10932

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...

CVE-2020-10932

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...

CVE-2020-10932

An issue was discovered in Arm Mbed TLS before 2.16.6 and 2.7.x before 2.7.15. An attacker that can get precise enough side-channel measurements can recover the long-term ECDSA private key by 1 reconstructing the projective coordinate of the result of scalar multiplication by exploiting side...