4470 matches found
Double-signing Attack
github.com/strangelove-ventures/horcrux is vulnerable to a double-signing attack. The vulnerability is due to a race condition in signature state handling when two independent events occurring within the same microsecond, allowing unintended duplicate signatures and leads to unintended...
CLSA-2025-1741624133 kernel: Fix of 5 CVEs
HID: core: zero-initialize the report buffer CVE-2024-50302 - Revert "drm/amdgpu: add missing size check in amdgpudebugfsgprwaveread" - drm/amd/amdgpu: Fix GPR read from debugfs v2 CVE-2024-50282 - USB: serial: ioedgeport: fix use after free in debug printk CVE-2024-50267 - wifi: iwlegacy: Clear...
kernel security update
4.18.0-553.44.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...
Horcrux Double Sign Possibility
Horcrux Incident Disclosure: Possible Double-Sign Summary On March 6, 2025, a Horcrux user 01node experienced a double-signing incident on the Osmosis network, resulting in a 5% slash penalty approximately 75,000 OSMO or $20,000 USD. After thorough investigation, we have identified a race conditi...
GHSA-6WXF-7784-62FP Horcrux Double Sign Possibility
Horcrux Incident Disclosure: Possible Double-Sign Summary On March 6, 2025, a Horcrux user 01node experienced a double-signing incident on the Osmosis network, resulting in a 5% slash penalty approximately 75,000 OSMO or $20,000 USD. After thorough investigation, we have identified a race conditi...
PT-2025-10136
Name of the Vulnerable Software and Affected Versions Horcrux versions 3.1.0 through 3.3.1 Description A race condition in Horcrux's signature state handling code allowed for a double-signing incident, resulting in a 5% slash penalty. The issue was introduced in July 2023 and affects all Horcrux...
Medium: openssl-snapsafe
Issue Overview: Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring...
Malicious code in ncw-eddsa-signing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02e9ad5aeea88c3f0f7df84384b93fd6ce2d6b3d1870fce2910d58ead5feaa87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Linux Distros Unpatched Vulnerability : CVE-2022-39250
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious...
GO-2025-3460 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution
Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT in github.com/distribution/distribution...
CVE-2025-27416 Asking For Scratch Username And Password
Scratch-Coding-Hut.github.io is the website for Coding Hut. The website as of 28 February 2025 contained a sign in with scratch username and password form. Any user who used the sign in page would be susceptible to any other user signing into their account. As of time of publication, a fix is not...
OESA-2025-1190 edk2 security update
EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing...
kernel security update
5.14.0-503.26.15.OL9 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...
Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
Impact A vulnerability in Rancher has been discovered, leading to a local user impersonation through SAML Authentication on first login. The issue occurs when a SAML authentication provider AP is configured e.g. Keycloak. A newly created AP user can impersonate any user on Rancher by manipulating...
MGASA-2025-0070 Updated neomutt packages fix security vulnerabilities
The To and Cc email header fields are not protected by cryptographic signing. CVE-2024-49393 The In-reply-to email header field is not protected by cryptographic signing. CVE-2024-49394...
Updated neomutt packages fix security vulnerabilities
The To and Cc email header fields are not protected by cryptographic signing. CVE-2024-49393 The In-reply-to email header field is not protected by cryptographic signing. CVE-2024-49394...
CVE-2024-39327
Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way...
CVE-2024-39327
Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way...
