3512 matches found
Input validation
A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page...
CVE-2017-5107
The CVE-2017-5107 entry describes a timing-based information disclosure in Google Chrome's SVG rendering prior to 60.0.3112.78, enabling a remote attacker to extract pixel values from a cross-origin page loaded in an iframe on Linux/Windows/macOS. The connected sources corroborate Chrome/Chromium...
CVE-2017-5107
Removed by vendor...
CVE-2017-5107
A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page...
OracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0165)
The remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf CVE-2013-5211 - fix buffer overflow in datum refclock driver CVE-2017-6462 - fix crash with invalid unpeer command CVE-2017-6463 - fix potential crash with...
Network Time Protocol libntp Message Digest Disclosure Vulnerability(CVE-2016-1550)
SUMMARY An exploitable vulnerability exists in the message authentication functionality of Network Time Protocol libntp. An attacker can send a series of crafted messages to attempt to recover the message digest key. TESTED VERSIONS ntp 4.2.8p4 NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
jasypt: Vulnerable to timing attack against the password hash comparison
A vulnerability was found in Jasypt that would allow an attacker to perform a timing attack on password hash comparison...
Ian Dunn: Timing Attack in Google Authenticator - Per User Prompt
Google Authenticator - Per User Prompt contains a timing attack vulnerability in how it validates the application password for a user account. if sha1 $attemptedpasswordplaintext === $validpasswordhash || wpcheckpassword $attemptedpasswordplaintext, $validpasswordhash...
SilverStripe CMS User Enumeration Vulnerability
SilverStripe CMS is a New Zealand SilverStripe company's open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A security vulnerability exists in the login and password reset forms in SilverStripe C...
Timing Attack Via Discrepancies In Response
silverstripe/cms is vulnerable to timing attacks. There are some discrepancies in the password reset and login form responses which can be misused by the attacker to enumerate the users...
CVE-2017-12849
Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks...
CVE-2017-12849
SilverStripe CMS contains a timing-based user enumeration vulnerability in login and password reset forms. CVE-2017-12849 affects SilverStripe CMS versions prior to 3.5.5 and 3.6.x prior to 3.6.1, enabling remote attackers to determine valid usernames via response timing differences. Multiple con...
Timing Attack
namshi/jose is vulnerable to timing attack. The vulnerability exists because it does not use a constant-time comparison when verifying HMAC values...
Timing Attack
symfony/security is vulnerable to timing attacks. The attacks are possible because BasePasswordEncoder hashes are not compared using constant time...
BSA-2017-445
Security Advisory ID : BSA-2017-445 Component : DENX Das U-Boot Revision : 3.0: Final Das U-Boot is a devicebootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper...
SS-2017-005: User enumeration via timing attack on login and password reset forms
More info at https://www.silverstripe.org/download/security-releases/ss-2017-005/...
Laravel Security Bypass Vulnerability
Laravel is a PHP development framework for developing web applications and provides syntax highlighting, documentation and extension packages. A security vulnerability exists in Laravel versions prior to 5.5.10 that stems from the program failing to properly handle the rememberme token validation...
RHEL 6 : Red Hat JBoss Enterprise Application Platform (RHSA-2017:2809)
The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2809 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red...