44 matches found
BIT-JOOMLA-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
DEBIAN-CVE-2024-13939
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...
UBUNTU-CVE-2024-13939
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...
CVE-2024-13939 String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...
MetaCPAN String::Compare::ConstantTime 安全漏洞
MetaCPAN String::Compare::ConstantTime is a component of the MetaCPAN Foundation. A security vulnerability exists in MetaCPAN String::Compare::ConstantTime version 0.321 and earlier, which stems from a timing attack that could disclose the length of a secret string...
Insufficient Entropy
Overview Affected versions of this package are vulnerable to Insufficient Entropy due to the use of an insufficient default, OTP shared secret length. Workaround If upgrading to the fixed version is not possible, users are advised to override the default otpsecretlength attribute in the model whe...
PT-2024-39260 · Rubygems +3 · Devise-Two-Factor +3
Name of the Vulnerable Software and Affected Versions: Devise-Two-Factor versions 1.0.0 or = 2.2.0 through = 2.2.0 through 6.0.0, upgrade to version v6.0.0 as soon as possible. If upgrading is not possible, override the default otp secret length attribute in the model when configuring two factor...
The vulnerability of the secure_compare() function in the Mojolicious module allows a hacker to obtain the length of the secret string.
The vulnerability of the securecompare function in the Mojolicious module relates to manipulating an unknown input, which leads to a timing mismatch vulnerability. Exploiting this vulnerability could allow a remote attacker to obtain the length of the secret string...
SUSE CVE-2022-48687
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes:...
DEBIAN-CVE-2022-48687
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes:...
UBUNTU-CVE-2022-48687
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix out-of-bounds read when setting HMAC data. The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes:...
SUSE CVE-2020-36829
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
AZL-45018 CVE-2020-36829 affecting package perl-Mojolicious 8.57-3
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
DEBIAN-CVE-2020-36829
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
AZL-43936 CVE-2020-36829 affecting package perl-Mojolicious 8.57-3
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
UBUNTU-CVE-2020-36829
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...
PT-2022-10472
Name of the Vulnerable Software and Affected Versions openstack-keystone affected versions not specified Description A flaw was found in openstack-keystone, where only the first 72 characters of an application secret are verified. This allows attackers to bypass some password complexity that...
CVE-2021-23127
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
CVE-2021-23127 [20210301] - Core - Insecure randomness within 2FA secret generation
An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to RFC 4226 of 10 bytes vs 20 bytes...
PT-2021-15382 · Joomla · Joomla!
Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.2.0 through 3.9.24 Description: An issue was discovered in the usage of an insufficient length for the 2FA secret according to RFC 4226, where 10 bytes were used instead of the recommended 20 bytes. Recommendations: For...