217 matches found
EUVD-2021-27057
Malware in sbrugna...
EUVD-2020-3020
Malware in sbrugna...
EUVD-2021-1085
Malware in sbrugna...
EUVD-2021-0049
Malware in sbrugna...
EUVD-2021-0151
Malware in sbrugna...
EUVD-2021-18741
Malware in sbrugna...
EUVD-2023-38438
Malicious code in bioql PyPI...
EUVD-2024-3440
Malicious code in bioql PyPI...
EUVD-2025-8542
Malicious code in bioql PyPI...
EUVD-2021-34105
Malicious code in bioql PyPI...
EUVD-2024-38221
Malicious code in bioql PyPI...
curl: Timing Attack Vulnerability in curl Digest Authentication via Non-Constant-Time String Comparison
Summary: A timing attack vulnerability exists in curl's Digest Authentication implementation due to the use of non-constant-time string comparison strcmp when comparing authentication algorithms in digest.c line 360. This allows attackers to determine the supported authentication algorithm throug...
GHSA-C2FC-9Q9C-5486 Dragonfly vulnerable to timing attacks against Proxy’s basic authentication
Impact The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison...
The vulnerability of the strcmp/memcmp function in the web interface of DrayTek Vigor software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the strcmp/memcmp function in the web interface of DrayTek Vigor software lies in the ability to disclose information through mismatches. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
CVE-2025-6386
The parisneo/lollms repository is affected by a timing attack vulnerability in the authenticateuser function within the lollmsauthentication.py file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The...
CVE-2021-3797
hestiacp is vulnerable to Use of Wrong Operator in String Comparison...
CVE-2015-20110
JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first character that is different. Attackers can guess tokens by brute forcing one character at a time and observing the timing. This of course drastically reduces t...
[SECURITY] Fedora 41 Update: perl-String-Compare-ConstantTime-0.321-21.fc41
This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...
[SECURITY] Fedora 42 Update: perl-String-Compare-ConstantTime-0.321-22.fc42
This module provides one function, "equals", which works like perl's "eq", but which does not provide a timing side-channel. Such comparison is useful when matching against a secret string...
DEBIAN-CVE-2024-13939
String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string. As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string m...