Security Bulletin: App Connect for Manufacturing 2.0 is affected by vulnerabilities of ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.6 (CVE-2019-17359)

Summary App Connect for Manufacturing 2.0 is affected by vulnerabilities of the ASN.1 parser in Bouncy Castle Crypto aka BC Java1.63 which were reported and have been addressed. Vulnerability Details CVEID: CVE-2019-17359 DESCRIPTION: Bouncy Castle Crypto is vulnerable to a denial of service,...

Security Bulletin: Multiple Bouncy Castle Vulnerabilities Affect IBM Sterling B2B Integrator

Summary IBM Sterling B2B Integrator has addressed multiple security vulnerabilities from Bouncy Castle. Vulnerability Details CVEID: CVE-2016-1000338 DESCRIPTION: Bouncy Castle JCE Provider could provide weaker than expected security, caused by improper validation of ASN.1 encoding of signature i...

Hash Collision

Bouncy Castle is vulnerable to hash collision attacks. The library keystore files uses a HMAC hash that is only 16 bits long, allowing a malicious user to retrieve the password used for keystore integrity verification checks. This vulnerability only affects users of the BKS-V1 keystore format,...

highcastletv.ru Cross Site Scripting vulnerability OBB-1478934

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

DEBIAN-CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

UBUNTU-CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

CVE-2020-26939

CVE-2020-26939 : Affects Legion of the Bouncy Castle BC (before 1.61) and BC-FJA (before 1.0.1.2). The OAEPEncoding path can leak information about the RSA private exponent when an invalid ciphertext decrypts to a short payload, via early exceptions in the OAEP decoder. Consequence is partial dis...

CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext tha...

bouncycastle15 -- bcrypt password checking vulnerability

The Bouncy Castle team reports: The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different...

leeds-castle.com Cross Site Scripting vulnerability OBB-1276240

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

PT-2020-6924 · Bouncy Castle +1 · Bouncy Castle Bc C# .Net +3

Name of the Vulnerable Software and Affected Versions: Bouncy Castle BC Java versions 1.65 and earlier Bouncy Castle BC C .NET versions 1.8.6 and earlier Bouncy Castle BC-FJA versions 1.0.2.0 and earlier Bouncy Castle BC-FNA versions 1.0.1.0 and earlier Description: The issue is related to a timi...

The Bouncy Castle Crypto APIs -- EC math vulnerability

The Bouncy Castle team reports:: Bouncy Castle BC Java before 1.66 has a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures...

Castle Rock Computing SNMPc Online has an Unspecified Vulnerability

Castle Rock Computing SNMPc Online is an advanced reporting plug-in for SNMPc Enterprise Network Manager from Castle Rock Computing, USA. Castle Rock Computing SNMPc Online suffers from an unspecified vulnerability that originates from a cookie value with a username and password in plaintext form...

Castle Rock Computing SNMPc Online suffers from an unspecified vulnerability (CNVD-2020-22330)

Castle Rock Computing SNMPc Online is an advanced reporting plug-in for SNMPc Enterprise Network Manager from Castle Rock Computing, USA. An unspecified vulnerability exists in Castle Rock Computing SNMPc Online. The vulnerability can be exploited to obtain sensitive information via the info.php4...

Castle Rock Computing SNMPc Online Cross-Site Scripting Vulnerability

Castle Rock Computing SNMPc Online is an advanced reporting plug-in for SNMPc Enterprise Network Manager from Castle Rock Computing, USA. A cross-site scripting vulnerability exists in Castle Rock Computing SNMPc Online. The vulnerability stems from a lack of proper validation of client data by t...

Castle Rock Computing SNMPc Online suffers from an unspecified vulnerability (CNVD-2020-22331)

Castle Rock Computing SNMPc Online is an advanced reporting plug-in for SNMPc Enterprise Network Manager from Castle Rock Computing, USA. An unspecified vulnerability exists in Castle Rock Computing SNMPc Online. An attacker could exploit the vulnerability to obtain sensitive credential informati...