PYSEC-2024-3

PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack...

Improper Authorization

github.com/mattermost/mattermost is vulnerable to Improper Authorization. The vulnerability is caused due to improper permission validation while a user views archived public channels. One member of a team can view a channel of another team member via GET call to the /api/v4/teams//channels/delet...

Stable Channel Update for Desktop

The Stable channel has been updated to 120.0.6099.199 for Mac,Linux and 120.0.6099.199/200 to Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 120.0.6099.199 for Mac and...

GHSA-W88V-PJR8-CMV2 Mattermost viewing archived public channels permissions vulnerability

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

Mattermost viewing archived public channels permissions vulnerability

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

CVE-2023-47858

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

Code injection

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

CVE-2023-47858 Details of archived public channels are leaked to members of another team

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

CVE-2023-47858 Details of archived public channels are leaked to members of another team

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

CVE-2023-47858 Details of archived public channels are leaked to members of another team

Mattermost fails to properly verify the permissions needed for viewing archived public channels, allowing a member of one team to get details about the archived public channels of another team via the GET /api/v4/teams//channels/deleted endpoint...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from US-based Mattermost. Mattermost suffers from a security vulnerability that stems from a permission validation error that allows an attacker to obtain details of another team via the get/api/v4/teams//channels/deleted endpoint...

CVE-2023-50901

creationtimestamp| type| source ---|---|--- 2023-12-29 12:26:34+00:00| seen| https://t.me/ctinow/160454 2023-12-30 01:37:49+00:00| seen| https://t.me/cibsecurity/73939 2024-01-21 12:36:46+00:00| seen| https://t.me/ctinow/170820...

PT-2023-14944 · Scone · Scone

Name of the Vulnerable Software and Affected Versions: SCONE versions prior to 5.8.0 Description: The issue is related to the improper initialization of x87 and SSE floating-point configuration registers in the scone entry component of SCONE for Intel SGX. This allows a local attacker to compromi...

Stable Channel Update for Desktop

The Stable channel has been updated to 120.0.6099.129 for Mac,Linux and 120.0.6099.129/130 to Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the nulllog. The Extended Stable channel has been updated to 120.0.6099.129 for Mac and...

CVE-2022-0320

creationtimestamp| type| source ---|---|--- 2023-12-18 10:58:01+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/9608 2024-08-16 08:57:34+00:00| published-proof-of-concept| https://t.me/Rootsec2/2289...

The sound of you typing on your keyboard could reveal your password

As if password authentications coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. The technique, developed at Durham University, the University of Surrey, and Royal Holloway University of London, builds on previous work to produce a more accurate...

SpyLoan Scandal: 18 Malicious Loan Apps Defraud Millions of Android Users

Cybersecurity researchers have discovered 18 malicious loan apps for Android on the Google Play Store that have been collectively downloaded over 12 million times. "Despite their attractive appearance, these services are in fact designed to defraud users by offering them high-interest-rate loans...

PT-2023-32671 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns a failure to validate route parameters in the Mattermost webapp, specifically in the //channels/ path, allowing an attacker to perform a client-side path traversal...

DEBIAN-CVE-2023-45287

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

Design/Logic Flaw

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...