2452 matches found
CVE-2014-9970
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
UBUNTU-CVE-2014-9970
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
CVE-2014-9970
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
CVE-2014-9970
CVE-2014-9970 affects jasypt before 1.9.2, where a timing attack can be made against password hash comparisons. The provided documents confirm the existence of this timing vulnerability but do not specify a vendor patch or fixed version within the CVE entry. The impact is described as a confident...
CVE-2014-9970
jasypt before 1.9.2 allows a timing attack against the password hash comparison...
OpenJDK: non-constant time GCM authentication tag comparison (JCE, 8143945)
It was discovered that the GCM Galois/Counter Mode implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag...
SUSE-SU-2017:1222-1 Security update for Botan
This update for Botan to version 1.10.9 fixes the following issues: These security issues were fixed: - CVE-2015-5726: The BER decoder in Botan 0.10.x allowed remote attackers to cause a denial of service application crash via an empty BIT STRING in ASN.1 data bsc968025. - CVE-2015-5727: The BER...
Timing Attack
github.com/btcsuite/btcd is vulnerable to timing attacks. This vulnerability is caused because hashes are not compared in constant time, allowing malicious users to guess valid hashes based on the time that a comparison takes...
Timing Attack
github.com/hashicorp/vault is vulnerable to timing attacks. This vulnerability is caused because passwords are not compared in constant time, allowing malicious users to guess valid passwords based on the time that a comparison takes...
Timing Attack
radicale is vulnerable to timing attacks. It does not compare passwords in constant time, because it uses a non-constant character to character comparison. Consequently, the comparison will fail faster when the first characters in the password are incorrect. Attackers can exploit this difference ...
Timing Attack
github.com/bitly/oauth2proxy is vulnerable to timing attacks. This vulnerability is caused because the cookies are not compared in constant time, allowing malicious users to guess the valid cookies based on the time that a comparison takes...
Timing Attack
github.com/dgrijalva/jwt-go is vulnerable to timing attacks. This vulnerability is caused because the hashes are not compared in constant time, allowing malicious users to guess the valid hashes are based on the time that a comparison takes...
Timing Attacks
github.com/go-martini/martini is vulnerable to timing attacks. This vulnerability is caused because the passwords are not compared in constant time, allowing malicious users to guess the valid passwords based on the time that a comparison takes...
Timing Attack
github.com/mholt/caddy is vulnerable to timing attacks. This vulnerability is caused because credentials are not compared in constant time, allowing malicious users to guess valid credentials based on the time that a comparison takes...
Node.js Security Scanner: Web Exploit Detector
Node.js Security Scanner: Web Exploit Detector The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites...
Linux/x86 - Egg-hunter Shellcode (18 bytes)
Linux/x86 - Egg-hunter Shellcode 18 bytes. Shellcode exploit for Linx86 platform // Description: a 18 bytes egg hunter on contigous memory segments // // You are free to do whatever you want of this shellcode // // @phacktul / global start section .text start: mov eax, start ; we set a valid .tex...
Microsoft Edge: Use-after-free in TypedArray.sort（CVE-2016-7288）
There is a use-after-free in the TypedArray. sort. In TypedArrayCompareElementsHelper https://chromium.googlesource.com/external/github.com/Microsoft/ChakraCore/+/TimeTravelDebugging/lib/Runtime/Library/TypedArray.cpp, the comparison function is called with the following code: Var retVal =...
DEBIAN-CVE-2016-7957
In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings...
