8705 matches found
Huawei EulerOS: Security Advisory for nss-softokn (EulerOS-SA-2020-1754)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for nettle (EulerOS-SA-2020-1752)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for nss (EulerOS-SA-2020-1718)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2021-6718
Name of the Vulnerable Software and Affected Versions Arm Mbed TLS versions prior to 2.23.0 Description The issue is related to a side channel in modular exponentiation, which could disclose an RSA private key used in a secure enclave. This is due to a dependency of the instruction timing on the...
Authorization Bypass
express-jwt is vulnerable to authentication bypass. The algorithms entry which are to be specified in the configuration are not enforced and when they are not specified in the configuration, it can lead to authorization bypass when used with jwks-rsa...
EulerOS Virtualization 3.0.6.0 : nettle (EulerOS-SA-2020-1752)
According to the version of the nettle packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypte...
EulerOS Virtualization 3.0.6.0 : openssl098e (EulerOS-SA-2020-1774)
According to the versions of the openssl098e package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A NULL pointer dereference was found in the way OpenSSL handled certain PKCS7 inputs. An attacker able to make an application...
EulerOS Virtualization 3.0.6.0 : nss-softokn (EulerOS-SA-2020-1754)
According to the versions of the nss-softokn packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. Thi...
Debian DLA-2266-1 : nss security update
Several vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2020-12399 Force a fixed length for DSA exponentiation. CVE-2020-12402 Side channel vulnerabilities during RSA key generation. For Debian 8 'Jessie', these problems have been fixed in version 2:3.26-1+debu8u11...
EulerOS Virtualization 3.0.6.0 : nss (EulerOS-SA-2020-1718)
According to the version of the nss packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a...
[SECURITY] [DLA 2266-1] nss security update
Package : nss Version : 2:3.26-1+debu8u11 CVE ID : CVE-2020-12399 CVE-2020-12402 Several vulnerabilities were fixed in nss, the Network Security Service libraries. CVE-2020-12399 Force a fixed length for DSA exponentiation. CVE-2020-12402 Side channel vulnerabilities during RSA key generation. Fo...
CVE-2020-15084
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
Authorization
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
CVE-2020-15084 Authorization bypass in express-jwt
In express-jwt NPM package up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this...
CVE-2020-15084
CVE-2020-15084 affects express-jwt up to version 5.3.3, where the algorithms configuration is not enforced when using jwks-rsa as the secret, potentially allowing authorization bypass. The issue is resolved in version 6.0.0; remediation is to explicitly configure allowed algorithms (e.g., RS256) ...
Authorization bypass in express-jwt
Overview Versions before and including 5.3.3, we are not enforcing the algorithms entry to be specified in the configuration. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. Am I affected? You are affected by this...
GHSA-6G6M-M6H5-W9GF Authorization bypass in express-jwt
Overview Versions before and including 5.3.3, we are not enforcing the algorithms entry to be specified in the configuration. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. Am I affected? You are affected by this...
PT-2020-14172
Name of the Vulnerable Software and Affected Versions express-jwt versions 5.3.3 and earlier Description The issue arises when the algorithms entry is not specified in the configuration, potentially leading to authorization bypass when used with libraries like jwks-rsa as the secret. This occurs...
Security Vulnerabilities fixed in Firefox 78 — Mozilla
When %2F was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. A VideoStreamEncoder may have been freed in a race...
