GHSA-8VPW-MGPF-MPVV Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests...

wpa_supplicant: SAE side channel attacks as a result of cache access patterns

The implementations of EAP-pwd in hostapd before 2.10 and wpasupplicant before 2.10 are vulnerable to side-channel attacks as a result of cache access patterns. The highest threat from this vulnerability is to availability, confidentiality and integrity...

Improper Input Validation in Bouncy Castle

The TLS implementation in the Bouncy Castle Java library before 1.48 and C library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attack...

GHSA-V882-949X-6V28 SimpleSAMLphp allows timing side-channel attacks

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

SimpleSAMLphp allows timing side-channel attacks

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

CVE-2022-24043

A vulnerability has been identified in Desigo DXR2 All versions V01.21.142.5-22, Desigo PXC3 All versions V01.21.142.4-18, Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The login functionality of the application fails to normalize the response times o...

CVE-2022-24043

Siemens Desigo DXR2, PXC3, PXC4 and PXC5 are affected by CVE-2022-24043 due to a login-side-channel: the system does not normalize response times between failed logins with wrong usernames and correct usernames, enabling username enumeration. Affected versions are: Desigo DXR2 < v01.21.142.5-2...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-006 (ALASKERNEL-5.4-2022-006)

The version of kernel installed on the remote host is prior to 5.4.141-67.229. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-006 advisory. A flaw was found in the Linux kernel. This flaw allows attackers to cause a denial of service soft lockup b...

Google Android Information Disclosure Vulnerability (CNVD-2022-44552)

Google Android is a Linux-based open source operating system from Google, Inc. An information disclosure vulnerability exists in Google Android, which stems from a side-channel information disclosure that could compromise installed packages. An attacker could exploit the vulnerability to cause a...

Slackware: Security Advisory (SSA:2013-287-03)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2013-242-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2013-215-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:0716-2 Security update for wpa_supplicant

This update for wpasupplicant fixes the following issues: - CVE-2022-23303: Fixed side-channel attacks in SAE bsc1194732. - CVE-2022-23304: Fixed side-channel attacks in EAP-pwd bsc1194733...

Medium: libgcrypt

Issue Overview: A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP. The highest threat from this vulnerability is to confidentiality...

Medium: libgcrypt

Issue Overview: A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to decrypt parts of ciphertext encrypted using Elgamal, for example, when using OpenPGP. The highest threat from this vulnerability is to confidentiality...

Google Android Information Disclosure Vulnerability (CNVD-2022-26767)

Google Android is a Linux-based open-source operating system from the U.S. company Google Google. Google Android has a security vulnerability, which stems from the leakage of side-channel information in Framework and can be used by attackers to obtain sensitive information...

Amazon Linux AMI : libgcrypt (ALAS-2022-1578)

The version of libgcrypt installed on the remote host is prior to 1.5.3-12.20. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1578 advisory. A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to...

Google Android Information Disclosure Vulnerability (CNVD-2022-26763)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a security vulnerability that stems from the disclosure of side-channel information in settings, which can be exploited by attackers to obtain sensitive information...

Amazon Linux 2 : libgcrypt (ALAS-2022-1769)

The version of libgcrypt installed on the remote host is prior to 1.5.3-14. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1769 advisory. A side-channel attack flaw was found in the way libgcrypt implemented Elgamal encryption. This flaw allows an attacker to decryp...