ssh-enum

ssh-enum Estudio de Validación Estadística de CVE-2016-6210 Una reinvestigación reproducible de la enumeración de nombres de usuario de OpenSSH mediante análisis estadístico. Este proyecto reinvestiga CVE-2016-6210 , un canal lateral de temporización documentado de OpenSSH, para determinar si sig...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

Canal Encubierto Combinado: CVE-2023-1206 + CVE-2024-49882 Resumen Este proyecto demuestra un canal de comunicación encubierto utilizando dos vulnerabilidades del kernel de Linux: Componente| CVE| Propósito ---|---|--- Canal de Sincronización| CVE-2023-1206| Sincronización de reloj mediante...

[SECURITY] [DLA 4791-1] memcached security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 23, 2026 https://wiki.debian.org/LTS -...

Debian dla-4791 : memcached - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4791 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4791-1 [email protected]...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...

CVE-2026-4567-Post-Quantum-KEM-Timing-Side-Channel-Kyber-Decapsulation-

2. CVE-2026-4567 – Canal lateral de temporización del KEM post-cuántico desencapsulación de Kyber Resumen Una implementación vulnerable de la desencapsulación del KEM Kyber filtra bits de la clave secreta a través de diferencias de temporización en el paso de rechazo del texto cifrado, lo que...

AVX-Side-Channel

Canal lateral de temporización basado en AVX — Detección de ASLR Autor: Byte Reaper Descripción script que demuestra la detección de ASLR mediante una carga de memoria AVX + temporización con RDTSCP y detección opcional de SIGSEGV. Requisitos : Linux x8664 GCC con -mavx2 CPU que soporte AVX2 y...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58272 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for...

CVE-2026-58272

Sync-in Server (open-source file storage and collaboration platform) prior to 2.4.1 exposes a timing side-channel on the POST /api/auth/login endpoint. The root cause is that authentication attempts for nonexistent accounts skip the bcrypt comparison performed for existing accounts, producing a m...

K000163349: Gnutls vulnerability CVE-2026-5419

Security Advisory Description A flaw was found in gnutls. The PKCS7 padding check, performed during decryption, was not constant-time. This timing side-channel could allow a remote attacker to potentially leak sensitive information about the padding bytes through observable timing differences. Th...

CVE-2026-8794

CVE-2026-8794 — Enumeración de nombres de usuario mediante canal lateral de tiempo en la autenticación de PaperCut NG Campo| Detalles ---|--- ID CVE| CVE-2026-8794 Producto| PaperCut NG Versión afectada| 25.0.11 Build 75758 y anteriores CWE| CWE-208 — Discrepancia temporal observable Puntuación...

EulerOS Virtualization 2.11.0 : shim (EulerOS-SA-2026-3560)

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext acros...

EulerOS Virtualization 2.11.1 : shim (EulerOS-SA-2026-3473)

According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext acro...

EulerOS Virtualization 2.11.1 : openssl (EulerOS-SA-2026-3448)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Issue summary: Use of the low-level GF2^m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to...

CVE-2026-84308

A flaw was found in phpseclib, a PHP secure communications library. This vulnerability arises from non-constant-time X25519 scalar multiplication, where data-dependent conditional modular reductions create observable timing differences or variations in libgmp call counts. A local attacker, capabl...

Astra Linux – Vulnerability in mbedtls

A timing side channel in mbedtlsssldecryptbuf in library/sslmsg.c in Trusted Firmware Mbed TLS from version 2.23.0 allows an attacker to obtain secret key information. This issue affects the CBC mode, as it involves a calculated time difference based on the padding length...

Astra Linux – Vulnerability in OpenSSL

Issue summary: A timing side-channel that could potentially allow the recovery of the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow an attacker to recover the private key. However, measuring the timing woul...

Astra Linux – Vulnerability in Erlang

A vulnerability in the Observable Timing Discrepancy mechanism in Erlang/OTP’s SSH libraries modules sshauth and sshoptions allows unauthenticated remote users to enumerate usernames through timing side-channels during password authentication. When the SSH daemon is configured with the...