The vulnerability of implementations of standards PKCS#1 v1.5, OAEP, and RASASVP in the NSS (Network Security Services) library allows a attacker to execute the Bleichenbacher attack or the Marvin attack.

The vulnerability of implementations of standards PKCS1 v1.5, OAEP, and RASASVP in the NSS Network Security Services library set is related to insufficient protection of service data due to timing discrepancies. Exploiting this vulnerability allows a remote attacker to execute the Bleichenbacher...

Limit accrueConcentratedPositionTimeWeightedLiquidity calls to prevent reward manipulation.

Lines of code Vulnerability details Impact It may be possible for a user to artificially increase their tracked liquidity right before claiming by rapidly entering/exiting positions. This could allow them to claim a larger % of rewards than they deserve. Proof of Concept The main risk of...

Transactions could be frontrun to deposit assets and collect shares between the deposit request and collection

Lines of code Vulnerability details Impact Attacker can spoof deposit to get free shares. Proof of Concept requestDeposit - Requests a deposit, locks up the assets. collectDeposit - Collects the shares after deposit execution. The vulnerability arises because: requestDeposit locks up the assets,...

CVE-2023-40182 silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or not

Silverware Games is a premium social network where people can play games online. When using the Recovery form, a noticeably different amount of time passes depending of whether the specified email address presents in our database or not. This has been fixed in version 1.3.7...

Lack of protection when withdrawing Static Atoken

Lines of code Vulnerability details Impact The Aave plugin is associated with an ever-increasing exchange rate. The earlier a user wraps the AToken, the more Static Atoken will be minted and understandably no slippage protection is needed. However, since the rate is not linearly increasing,...

Important: gnutls

Issue Overview: A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, the attacker wou...

CVE-2023-1585

Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use TOCTOU vulnerability in the Quarantine process, leading to arbitrary file/directory deletion. The issue was fixed with Avast and AVG Antivirus version 22.11 and virus definitions from 14 February 2023 or later...

Design/Logic Flaw

The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabled support for DHE ciphersuites...

PT-2023-10334 · Viafintech · Viafintech Barzahlen Payment Module Php Sdk

Name of the Vulnerable Software and Affected Versions: viafintech Barzahlen Payment Module PHP SDK versions up to 2.0.0 Description: A vulnerability was found in the viafintech Barzahlen Payment Module PHP SDK, affecting the verify function of the file src/Webhook.php. The manipulation leads to...

Primecoin 安全漏洞

Primecoin is an experimental cryptocurrency open-sourced by Ziftr. A security vulnerability exists in Primecoin version 0.8.4rc1 and earlier versions, which stems from the fact that incorrect manipulation of the parameter strUserPass/strRPCUserColonPass can lead to noticeable timing differences...

CVE-2020-35168

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability...

CVE-2020-35167

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Observable Timing Discrepancy Vulnerability...

OTRS 安全漏洞

OTRS is an application from the German company OTRS. A service management software. A security vulnerability exists in OTRS versions 8.0.x through 8.0.23 and OTRS versions 7.0.x through 7.0.35, which stems from a difference in application response times. An attacker could exploit the vulnerabilit...

The vulnerability of TLS and SSL Mbed TLS implementations lies in the exposure of information due to incompatibilities, allowing attackers to gain access to confidential data.

The vulnerability of TLS and SSL Mbed TLS implementations lies in the use of base64 decoding functions with non-persistent execution time. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

UBUNTU-CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...

CVE-2021-37085

There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service...

CVE-2021-37085

There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service...

CVE-2021-37085

There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service...

Spoofing

There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service...

The vulnerability of the SAE implementation of the wpa_supplicant function for wireless communication devices with WPA certification lies in the fact that it exposes information, allowing attackers to gain access to confidential data.

The vulnerability of the SAE implementation of the wpasupplicant function for wireless communication devices with WPA certification is related to errors in timing and access patterns to the cache. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...