PT-2021-3955 · Unknown +2 · Mysql Server +3

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.2 Description: An issue was discovered in the Oauth extension for MediaWiki. The problem lies in MWOAuthConsumerSubmitControl.php, which does not ensure that the length of an RSA key will fit in a MySQL blob...

PT-2021-6813

Name of the Vulnerable Software and Affected Versions Mbed TLS version 2.24.0 Description A side-channel vulnerability in base64 PEM file decoding exists, allowing system-level attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software runni...

NewStart CGSL MAIN 6.02 : nss Multiple Vulnerabilities (NS-SA-2021-0053)

The remote NewStart CGSL host, running version MAIN 6.02, has nss packages installed that are affected by multiple vulnerabilities: - Improper refcounting of soft token session objects could cause a use-after-free and crash likely limited to a denial of service. This vulnerability affects Firefox...

EulerOS Virtualization 3.0.6.6 : bind (EulerOS-SA-2021-1458)

According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In BIND 9.0.0 - 9.11.21, 9.12.0 - 9.16.5, 9.17.0 - 9.17.3, also affects 9.9.3-S1 - 9.11.21-S1 of the BIND 9 Supported Preview...

PT-2021-28142

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is identified, related to the parsing of RSA keys. The crash occurs in the AK::ByteBuffer::overwrite function, specifical...

Huawei EulerOS: Security Advisory for bind (EulerOS-SA-2021-1458)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

serenity:FuzzRSAKeyParsing: Heap-buffer-overflow in AK::ByteBuffer::overwrite

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=4921721506365440 Project: serenity Fuzzing Engine: honggfuzz Fuzz Target: FuzzRSAKeyParsing Job Type: honggfuzzasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

EulerOS Virtualization for ARM 64 3.0.6.0 : nss-softokn (EulerOS-SA-2021-1536)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could...

PT-2021-28086

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow read issue is identified, related to the parsing of RSA keys. The crash occurs in the Crypto::der decode sequence and...

serenity:FuzzRSAKeyParsing: Heap-buffer-overflow in Crypto::UnsignedBigInteger::UnsignedBigInteger

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5566060432588800 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRSAKeyParsing Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

serenity:FuzzRSAKeyParsing: Heap-buffer-overflow in void AK::__format_value<unsigned char>

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5915819802492928 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRSAKeyParsing Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

serenity:FuzzRSAKeyParsing: Heap-buffer-overflow in Crypto::der_decode_integer

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6477451536498688 Project: serenity Fuzzing Engine: honggfuzz Fuzz Target: FuzzRSAKeyParsing Job Type: honggfuzzasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

serenity:FuzzRSAKeyParsing: Heap-buffer-overflow in Crypto::der_decode_sequence

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=6144879669411840 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzRSAKeyParsing Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

wolfssl:fuzzer-wolfssh-server-randomize: Crash in mp_read_unsigned_bin

Project: https://github.com/wolfssl/wolfssl.git Detailed Report: https://oss-fuzz.com/testcase?key=5912002306375680 Project: wolfssl Fuzzing Engine: libFuzzer Fuzz Target: fuzzer-wolfssh-server-randomize Job Type: libfuzzerasani386wolfssl Platform Id: linux Crash Type: UNKNOWN READ Crash Address:...

CentOS 8 : nss and nspr (CESA-2020:3280)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3280 advisory. - nss: Use-after-free in sftkFreeSession due to improper refcounting CVE-2019-11756 - nss: Check length of inputs for cryptographic primitives...

CVE-2020-28391

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0, SCALANCE X-200RNA switch family All versions V3.2.7. Devices create a new unique key upon factory reset...

Hardcoded credentials

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0, SCALANCE X-200RNA switch family All versions V3.2.7. Devices create a new unique key upon factory reset...

CVE-2020-28391

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0, SCALANCE X-200RNA switch family All versions V3.2.7. Devices create a new unique key upon factory reset...

CVE-2020-28391: Use of Hard-coded Cryptographic Key

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0, SCALANCE X-200RNA switch family All versions V3.2.7. Devices create a new unique key upon factory reset...

PYSEC-2020-143

tlslite-ng is an open source python library that implements SSL and TLS cryptographic protocols. In tlslite-ng before versions 0.7.6 and 0.8.0-alpha39, the code that performs decryption and padding check in RSA PKCS1 v1.5 decryption is data dependant. In particular, the code has multiple ways in...