CVE-2022-43933

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords...

CVE-2022-43933 configuration secrets are logged in support-save

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords...

PT-2024-35168

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2024.8.5 authentik version 2024.10.3 Description The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the SECRET KEY used to...

authentik 安全漏洞

authentik is an open source identity provisioning application from authentik open source. Authentik suffers from a security vulnerability that stems from an issue with the use of non-constant time comparisons in the /-/metrics/ endpoint, which makes SECRETKEY vulnerable to brute-force cracking...

cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs

Impact cert-manager packages which call the standard library pem.Decode function can take a long time to process specially crafted invalid PEM data. If an attacker is able to modify PEM data which cert-manager reads e.g. in a Secret resource, they may be able to use large amounts of CPU in the...

Malicious code in river-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28a856c975ffce278cd6752a94fda3cc892d9af33858cc33d5dcb4f0bdafeb62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

SUSE CVE-2024-47533

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

Cachi2 安全漏洞

Cachi2 is an open source CLI tool from containerbuildsystem. A security vulnerability exists in Cachi2 versions prior to 0.14.0, which stems from the fact that the tool logs each function's local variables when an unhandled exception is triggered, potentially leading to the display of secret...

GHSA-JP37-5QHW-MFFW Sharks has a Bias of Polynomial Coefficients in Secret Sharing

Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range 0, 255 they were instead in the range 1, 255. A description from Cure53, who originally found the issue, is available: The correct method to...

cryptoballot (>=0.2.0, <=0.3.1), secret-sharing-cli (>=0.1.0, <=0.1.2) +1 more potentially affected by unknown CVE via sharks (>=0.3.3, <=0.4.3)

sharks CARGO version =0.3.3, =0.2.0, =0.1.0, =0.1.0, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-JP37-5QHW-MFFW...

Sharks has a Bias of Polynomial Coefficients in Secret Sharing

Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range 0, 255 they were instead in the range 1, 255. A description from Cure53, who originally found the issue, is available: The correct method to...

cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes

Summary utils.getsharedsecret always returns -1 - allows anyone to connect to cobbler XML-RPC as user '' password -1 and make any changes. Details utils.py getsharedsecret: def getsharedsecret - Unionstr, int: """ The 'web.ss' file is regenerated each time cobblerd restarts and is used to agree o...

UBUNTU-CVE-2024-47533

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

Malicious code in odin-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88fb389e44efcf715a97b223a3b5d1df5427225000fc86af2138b7bcb3934375 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-40350 · Blahaj +1 · Blahaj +1

Name of the Vulnerable Software and Affected Versions: sharks crate affected versions not specified Description: The issue concerns a bias in generating random polynomials for Shamir Secret Sharing. Instead of coefficients being in the range 0, 255, they were in the range 1, 255. This allows an...

Malicious code in seller-return-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cb65c23332995d233b20a9c39f766a75b931d27ec3bb60ab9ee7a29268dce28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bias of Polynomial Coefficients in Secret Sharing

Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range 0, 255 they were instead in the range 1, 255. A description from Cure53, who originally found the issue, is available: The correct method to...

airframe_recovery_bundle (>=1.0.0, <=1.0.2), cryptoballot (>=0.2.0, <=0.3.1) +11 more potentially affected by unknown CVE via sharks (>=0.3.3, <=0.5.0)

sharks CARGO version =0.3.3, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.7.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0398...

RUSTSEC-2024-0398 Bias of Polynomial Coefficients in Secret Sharing

Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range 0, 255 they were instead in the range 1, 255. A description from Cure53, who originally found the issue, is available: The correct method to...