12876 matches found
CVE-2020-12627
Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...
CVE-2020-10187
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their...
CVE-2022-23003
When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero, the resulting output is not properly reduced modulo the P-256 field prime and is invalid. The resulting output may cause an error when used in other operations. This may be...
CVE-2021-41192
Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both that is the same across all installations. In such cases, th...
CVE-2024-41121
Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...
Malicious code in yunxohang7 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67a769d99a6a661851b61de53efc010814ffb939cd296c6f923849dc61f89b3f The package yunxohang7 was found to contain malicious code. Source: ghsa-malware 1b795328419a9d8a5a0cf95479488558080aafb9593636fccd0c5bbf500f5f55 Any...
MAL-2026-180 Malicious code in shreddit.styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cce1be43bf6e26a99a58a3f011f71a44d06f3227d24bf2274c9f3b41c0fc3de The package shreddit.styles was found to contain malicious code. Source: ghsa-malware 2c65bd95325c1ee64e6f0b45b33b62af1973c49ed5c4eed64c725d08a51201b...
MAL-2026-183 Malicious code in yunxohang11 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bcda0e592de29bfcadb36b9fc15f8e9286e6a900d24e8bfc6c377e6ed2c92c1 The package yunxohang11 was found to contain malicious code. Source: ghsa-malware fb0d6761dd8d1cd805af3477c095b5c7acdd92dd5eb9b0aa1c877e65f8ded822 An...
MAL-2026-174 Malicious code in dotenv-intended (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 321eaa257985bd47bbf31b2f7ccdaef2df5b424b7b257400a48140ef6029e670 The package dotenv-intended was found to contain malicious code. Source: ghsa-malware df2195d5589f3e44d82053db7cd9ae186dfd168b35c9db8f97baa29f0c63612...
MAL-2026-175 Malicious code in jwtdapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5222fd8fda1f00da9cfbd3e5bd457aaa90b6ea456aeb1ae2b9a5448dedc46b62 The package jwtdapp was found to contain malicious code. Source: ghsa-malware 916f8af27ab4818456f9abe642d6c4bcd8d3126e510e5a46e516a0fd45785d7d Any...
Malicious code in amdocs-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a6af3ffb67d97ff5a166cfa06c9dc841eab5d736ffbbdae5f3a693d7845be2 The package amdocs-core was found to contain malicious code. Source: ghsa-malware 19cbd66c5d36a7bcc61d3202596dea181a2782d867db3ea2cbb0e322f01b99db An...
The vulnerability of the Red Hat Ansible Automation Platform, related to the transmission of secret information in the form of open text, allows a perpetrator to gain unauthorized access to the protected information.
The vulnerability of the Red Hat Ansible Automation Platform relates to the transmission of secret information in the form of open text. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...
Siemens Ruggedcom ROX Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2022-34903)
GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line. This plugin only works with Tenable.ot. Please visit...
Use of a Cryptographic Primitive with a Risky Implementation
Overview org.webjars.npm:elliptic is a Fast elliptic-curve cryptography in a plain javascript implementation. Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation due to the incorrect computation of the byte-length of k value with leadin...
Use of a Cryptographic Primitive with a Risky Implementation
Overview elliptic is a fast elliptic-curve cryptography implementation in plain javascript. Affected versions of this package are vulnerable to Use of a Cryptographic Primitive with a Risky Implementation due to the incorrect computation of the byte-length of k value with leading zeros resulting ...
Elliptic Uses a Cryptographic Primitive with a Risky Implementation
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...
GHSA-848J-6MX2-7J84 Elliptic Uses a Cryptographic Primitive with a Risky Implementation
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...
DEBIAN-CVE-2025-14505
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...
CVE-2025-14505
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...
UBUNTU-CVE-2025-14505
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. This...