@codingsh/harmony-crypto (>=0.1.57, <=0.1.58) potentially affected by unknown CVE via scrypt-shim (0.0.1-security)

scrypt-shim NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on scrypt-shim and may be impacted: - @codingsh/harmony-crypto =0.1.57, =0.1.58 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5972...

MAL-2022-5972 Malicious code in scrypt-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35f2999053c0d8b7abe3dc46b17ee7c41b309ed661021067496ee77e569f923 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scrypt-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d35f2999053c0d8b7abe3dc46b17ee7c41b309ed661021067496ee77e569f923 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in scrypt-shim

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@codingsh/harmony-crypto (>=0.1.57, <=0.1.58) potentially affected by unknown CVE via scrypt-shim (0.0.1-security)

scrypt-shim NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on scrypt-shim and may be impacted: - @codingsh/harmony-crypto =0.1.57, =0.1.58 Source cves: unknown CVE Source advisory: GHSA-759H-5P5W-455R...

CVE-2016-20013

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service CPU consumption because the algorithm's runtime is proportional to the square of the length of the password...

AES256_Passwd_Store - Secure Open-Source Password Manager

This script securely encrypts or decrypts passwords on disk within a custom database file. It also features functionality to retrieve passwords from a previously generated database file. This script takes a master password from stdin/from memory, then hashes the password using the specified hashi...

Facebook HHVM Denial of Service Vulnerability

Facebook HHVM aka HipHop Virtual Machine is a virtual machine from Facebook that significantly improves the performance of loading dynamic pages in PHP. A security vulnerability exists in the call to the 'scryptenc' function in Facebook HHVM. The vulnerability can be exploited by an attacker with...

UBUNTU-CVE-2019-3570

Call to the scryptenc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r and p. This happens if the parameters are configurable by an attacker for instance by providing the output of scryptenc in a context where Hack/PHP code would attempt to verify it by...

PT-2019-16618

Name of the Vulnerable Software and Affected Versions HHVM versions 3.30.5 and below HHVM versions 4.0 through 4.2 HHVM versions 4.3.0 through 4.8.0 Description A call to the scrypt enc function in HHVM can lead to heap corruption by using specifically crafted parameters N, r, and p. This occurs...

Fedora 28 : botan2 (2018-eaa7de17ae)

Update Botan2 to 2.7.0. Focus of this release is on performance and side channel hardening. - Address side channels in RSA key generation and ECDSA signing - Side channel hardening in many core algorithms modular exponentiation, ECC scalar multiply, Karatsuba multiplication, Barrett reduction, et...

[SECURITY] Fedora 28 Update: python-pycryptodomex-3.6.6-1.fc28

PyCryptodome is a self-contained Python package of low-level cryptographic primitives. It's a fork of PyCrypto. It brings several enhancements with respect to the last official version of PyCrypto 2.6.1, for instance: Authenticated encryption modes GCM, CCM, EAX, SIV, OCB Accelerated AES on Intel...

Fedora 27 : botan2 (2018-98ab6b4e56)

Update Botan2 to 2.7.0. Focus of this release is on performance and side channel hardening. - Address side channels in RSA key generation and ECDSA signing - Side channel hardening in many core algorithms modular exponentiation, ECC scalar multiply, Karatsuba multiplication, Barrett reduction, et...

Cloud Client Side File Encryption: Cryptomator

Multi-platform transparent client-side encryption of your files in the cloud. Cryptomator provides transparent, client-side encryption for your cloud. Protect your documents from unauthorized access. Cryptomator is free and open source software, so you can rest assured there are no backdoors...

The scrypt parameters

The recommended scrypt parameters in the Go docs were recently brought up for discussion given they haven't changed since 2009. Even if at this point I memorized the three numbers N=16384, r=8, p=1 I only have a vague understanding of their meaning, so I took some time to read the scrypt paper...

The scrypt parameters

The recommended scrypt parameters in the Go docs were recently brought up for discussion given they havent changed since 2009. Even if at this point I memorized the three numbers N=16384, r=8, p=1 I only have a vague understanding of their meaning, so I took some time to read the scrypt paper. It...

GlobaLeaks: GlobaLeaks is vulnerable to timing attacks.

Dear GlobaLeaks bug bounty team, GlobaLeaks is vulnerable to timing attacks, because the checkpassword function performs a byte-by-byte comparison, which terminates early when two characters do not match. Summary --- Timing attacks are a type of side channel attack where one can discover valuable...

CollabNet Subversion Edge weak password storage mechanism

Vuln Title: The CollabNet Subversion Edge stores passwords as unsalted MD5 hashes Date: 28.06.2015 Author: otr Software Link: https://www.open.collab.net/downloads/svnedge Vendor: CollabNet Version: 4.0.11 Tested on: Fedora Linux Type: Insecure password storage Risk: Medium Status: public/fixed...

Battle Scrypt Shell Upload Vulnerability

No description provided by source. Exploit Title: Battle Scrypt Shell Upload Vulnerability Date: 19.05.2010 Author: DigitALL Software Link: http://www.scrypted.com/battlescrypt.html Tested on: Windows Xp Sp3 Code : d0rk: Powered by Battle Scrypt or inurl:upload.php For Script Kidde : Exploit: Go ...

Cpuminer - CPU miner for Litecoin and Bitcoin

cpuminer is a multi-threaded, highly optimized CPU miner for Litecoin, Bitcoin and other cryptocurrencies. Currently supported algorithms are SHA-256d and scrypt1024, 1, 1. It supports the getwork mining protocol as well as the Stratum mining protocol, and can be used for both solo and pooled...